Sr. Security Engineer - GRC APAC Fintech & Financial Services

Job Application for Sr. Security Engineer - GRC APAC Fintech & Financial Services at SpaceXAI

Back to jobs New Sr. Security Engineer - GRC APAC Fintech & Financial Services Tokyo, Japan

SpaceXAI’s mission is to create AI systems that can accurately understand the universe and aid humanity in its pursuit of knowledge. Our team is small, highly motivated, and focused on engineering excellence. This organization is for individuals who appreciate challenging themselves and thrive on curiosity. We operate with a flat organizational structure. All employees are expected to be hands-on and to contribute directly to the company’s mission. Leadership is given to those who show initiative and consistently deliver excellence. Work ethic and strong prioritization skills are important. All employees are expected to have strong communication skills. They should be able to concisely and accurately share knowledge with their teammates.

ABOUT THE ROLE:

We are seeking an experienced Governance, Risk, and Compliance (GRC) Engineer focused on Japanese information security and financial services regulation to help scale compliance for SpaceXAI and X Money. As we expand deeper into the regulated Japanese market, maintaining a robust, transparent, and technically sound information security GRC program is critical. You will architect the systems and processes that automate trust — a pragmatic operator who understands that GRC exists to enable the business, balancing rigorous standards with the velocity of a high-growth company. The ideal candidate brings hands-on experience with JFSA supervisory expectations, APPI, and local Japanese banking and payments technology controls, plus GRC engineering skills: Compliance-as-Code, continuous evidence collection, and deep partnership with engineering so controls are designed into the platform rather than bolted on after the fact. This role may also include additional tasks and responsibilities as needed to support the team and evolving business priorities. This position may require occasional travel.

RESPONSIBILITIES:

Own and evolve Japan financial services and payments compliance posture across JFSA supervisory expectations (including technology risk management, incident reporting, and third-party technology risk), APPI, and local Japanese banking and payments technology controls supporting X Money.

Build and maintain Compliance-as-Code capabilities — policy-as-code, automated control validation, continuous evidence collection, and monitoring integrated into CI/CD — so audit and supervisory readiness scales with the business rather than depending on manual, point-in-time checks.

Operate and extend GRC platforms (e.g., Vanta) as the backbone for control mapping, evidence management, and continuous compliance; integrate with cloud, identity, logging, and engineering systems to reduce administrative bottlenecks.

Partner with Architects and Engineering Leads to bake JFSA and APPI requirements into design early; translate complex Japanese regulatory obligations into concrete technical implementations and auditor- or supervisor-ready narratives without slowing development.

Design, implement, and validate technical controls relevant to Japanese banking and payments environments (access control, logging and monitoring, encryption, change management, vulnerability management, business continuity and disaster recovery, and secure SDLC) — not just document them.

Operate the cybersecurity and compliance risk register — identify, quantify, and track risks, distinguishing theoretical gaps from meaningful business and regulatory risk under JFSA supervisory expectations.

Lead risk assessments and compliance reviews for new products, payment flows, features, vendors, and architectural changes that affect the Japan regulated attack surface, including third-party technology risk and subcontractor/sub-processor oversight.

Liaise with Legal and the Data Privacy team on security-relevant intersections with APPI, including security measures for personal data and breach/incident reporting aligned to applicable JFSA expectations.

Own and cultivate relationships with external auditors, assessors, and (where applicable) JFSA supervisory contacts; serve as the bridge between external parties and internal teams so requests are reasonable, clear, and relevant to our stack.

Develop, maintain, and continuously improve policies, standards, and procedures aligned to JFSA, APPI, and local banking and payments technology requirements, mapped to the control library shared with US Fintech to avoid duplicate control sets.

Champion pragmatic governance — prioritize issues that represent real security or business risk over checkbox compliance.

BASIC QUALIFICATIONS:

Bachelor's degree in computer science, Information Security, Cybersecurity, risk management, or an engineering/STEM field — or equivalent practical experience.

8+ years of experience owning or materially operating a GRC, information security compliance, or ISMS program in fintech, banking, payments, SaaS, or other regulated technology environments — with primary Japan exposure.

Demonstrable experience owning or materially operating an ISMS and control library, and experience supporting client security assurance, external audits, or regulatory evidence processes.

Hands-on experience with JFSA supervisory expectations and local Japanese banking and payments technology controls — including implementing or operating controls, not only reading the requirements.

Strong understanding of information security risk management, control assessment, risk treatment, and governance reporting to senior stakeholders.

Experience coordinating security incident response governance (escalation, communications, remediation tracking) and operating or improving supplier/third-party security assurance.

Working knowledge of APPI sufficient to partner with Privacy counterparts on security of personal data and incident support.

Technical fluency to partner with Engineering on cloud (AWS/GCP/Azure), identity, logging, and secure SDLC — and to evaluate control objectives against real configurations.

PREFERRED SKILLS AND EXPERIENCE:

10+ years of information security compliance, GRC engineering, or technology audit experience in fintech or financial services with a primary Japan focus.

Experience in a SaaS, fintech, financial services, regulated technology, or B2B enterprise software environment.

Hands-on experience implementing technical...