Technology & Cyber Risk Manager

Zero Hash is a leading infrastructure platform for digital assets and stablecoins, enabling banks, brokerages, fintechs and payment companies to offer crypto services without building blockchain systems from scratch. The company serves major financial brands including Morgan Stanley, Stripe, BlackRock and Interactive Brokers, and operates under deep regulatory oversight across multiple jurisdictions. Founded in 2017 and backed by over 280 million dollars in venture funding, Zero Hash has become a trusted partner for enterprises modernizing financial products while maintaining the highest standards for security and compliance.

As the Technology & Cyber Risk Manager, you will be an independent second-line voice assessing whether Zero Hash's 24/7 infrastructure meets the security standards its first line claims. Reporting to the Head of Risk rather than the CISO, you will evaluate and challenge controls protecting custody systems, infrastructure and customer-facing platforms, then translate those assessments into quantified risk views for senior leadership and the board. This is a foundational role where you will build the risk register, AI governance program and vendor technical diligence process from the ground up, with no inherited playbook to rely on.

What you'll do

• Build and maintain the cyber risk framework using FAIR methodology, establish risk appetite metrics, develop scenario libraries, and produce independent risk assessments for the board and senior leadership.

• Keep the technology and cyber risk register current and actionable rather than allowing it to become a static annual exercise.

• Review first-line security work including penetration test results, vulnerability assessments and control documentation, then issue independent opinions and escalate findings until remediation is complete.

• Partner with engineering and security teams to identify technology risks across infrastructure, applications and AI systems.

• Build the AI governance program from inception, including use case registries, risk classifications and oversight of AI systems accessing customer or transaction data.

• Conduct independent technical assessments of vendors that are critical to custody or security, feeding into the broader vendor risk program.

• Support regulatory and counterparty assessments as the second-line owner of technology risk.

What you'll bring

• At least 5 years in technology risk, cyber risk or information security risk, including 2+ years in a dedicated second-line role at a bank, insurer or regulated fintech separate from the security function you reviewed. Seven or more years is typical.

• A concrete example of escalating a finding despite real organizational resistance and successfully driving the control implementation.

• Ability to read first-line security assessments and form independent opinions that may differ from the first line's conclusions.

• Quantitative risk modeling experience, ideally FAIR, though actuarial work, statistics or engineering backgrounds also qualify.

• Exposure to institutional-grade third-party technology assessments, either as the assessor or as the vendor being evaluated.

• Strong writing skills for board and executive audiences, as risk committee and board reporting are core responsibilities.

Nice to have

• Open FAIR certification or equivalent quantitative risk credential.

• AI or model risk governance experience including model inventories and use case classification.

• Knowledge of DORA ICT risk requirements or similar EU regulatory frameworks.

• Background in digital assets, payments or crypto-regulated firms.

• Familiarity with post-quantum cryptography standards and cryptographic inventory frameworks.

What they offer

• Health insurance covering approximately 100 percent of employee premiums plus a portion of spouse and children coverage.

• Vision and dental insurance.

• Equity opportunity.

• Maternity and paternity leave after six months.

• WeWork All Access membership, annual work-from-home stipend and annual learning and development stipend after six months.