Technology & Cyber Risk Manager at Zero Hash

Job description

About the Job zerohash moves money and digital assets for banks, brokerages and payment companies, on infrastructure that has to be secure and available 24/7. We're hiring our Technology & Cyber Risk Manager to be the independent voice on whether that infrastructure is as safe as the first line says it is. This is a second-line role. You report to the Head of Risk, not the CISO, and you assess and challenge the controls protecting our custody systems, infrastructure and partner-facing platforms. You then turn that assessment into quantified risk views for senior leadership and the board. Our risk program is built on FAIR, so your work is measured in dollars and likelihoods, not red-amber-green. You are one of the first people in this function. The risk register, the AI governance program and the vendor technical diligence process are all yours to build, and there is no established team or playbook to inherit. This role is for someone who has taken a finding and pushed until the organization changed, including when engineering, a CISO or a launch date said no. If your past work was mostly producing assessments and registers, it is probably not the right fit. Responsibilities Build and own the cyber risk framework: methodology, risk appetite metrics and a FAIR scenario library. Produce independent risk views for senior leadership and the board. Keep the technology and cyber risk register live, not annual. Review and challenge first-line security work, including penetration test results, vulnerability metrics and control assessments, and issue independent risk opinions. Escalate and track findings until they are fixed. Partner with Engineering and Security to find risk across infrastructure, applications and AI systems. Build the AI governance program: use case registry, risk classification, and oversight of AI systems that touch end-user or transaction data. Provide independent technical risk assessments of custody-critical and security-critical vendors, as an input to the broader vendor risk program. Support regulatory and counterparty risk assessments as the second-line technology risk owner. Track emerging risks, including AI and model risk and cryptographic risk. Requirements 5+ years in technology risk, cyber risk or information security risk, including 2+ years in a dedicated second-line role at a bank, insurer or regulated fintech, in a function separate from the security team you reviewed. 7+ years is typical. A specific story of escalating a finding over real objections and getting the control implemented, not just documenting the gap. Experience reading first-line security work (pen test results, vulnerability metrics, control assessments) and forming an independent opinion that differs from the first line's. Quantitative risk modeling experience. FAIR is ideal. Other real modeling backgrounds, such as actuarial work, statistics or engineering, are welcome. Exposure to GSIB-caliber third-party technology assessments, as the assessor or as the vendor being assessed. Clear writing for boards and executives. Risk Committee and board reporting is a core deliverable. Preferred None of these is a requirement. We will teach what you haven't done yet. Open FAIR or equivalent quantitative risk certification. AI or model risk governance: model inventories, use case classification, human-in-the-loop design. Familiarity with DORA ICT risk requirements or similar EU regulation. Experience at a digital asset, payments or crypto-adjacent regulated firm. Familiarity with post-quantum cryptography standards and cryptographic inventory frameworks. Benefits Healthcare Insurance: zerohash covers roughly 100% of employee premiums as well as a portion of spouse/children (U.S. only) Vision & Dental Insurance (U.S. only) Chance to earn equity Maternity & Paternity leave (after 6 months) WeWork All Access Membership WFH Yearly Stipend L&D Yearly Stipend (after 6 months) About zerohash zerohash is the leading crypto and stablecoin infrastructur