Head of Security & Risk

Foundational individual contributor role reporting to the Deputy COO. The position will establish M0's enterprise risk management program, lead SOC 2 and ISO 27001 compliance efforts, design security operations and incident response frameworks, manage partner security due diligence, and build security awareness across the organization.

Responsibilities

• Build M0's enterprise risk management program, including risk registers, assessments, scenario analyses, and escalation frameworks.
• Own the information security compliance certification roadmap across SOC 2, ISO 27001, and applicable frameworks.
• Design and maintain incident response, ISMS documentation, security policies, business continuity, and disaster recovery exercises.
• Manage external security vendors, auditors, penetration testing firms, and compliance relationships.
• Lead institutional partner security due diligence and maintain reusable security documentation and questionnaire responses.
• Build and operate the company's security awareness training program and proactive security culture.

Requirements

• 7–10 years of experience in information security, risk, GRC, or compliance operations.
• Experience building compliance certification programs from scratch and owning a full SOC 2 audit cycle and ISO 27001 implementation or maintenance.
• Hands-on experience with GRC automation platforms such as Vanta or Drata, cloud security environments, and BCP/DR program design.
• Experience managing external audit relationships, penetration testing firms, compliance vendors, evidence collection, and report production.
• Working understanding of AWS, GCP, and Azure, including security controls in DevOps and IaaS environments.
• Preferred certifications include Cloud+, CySA+, CISSP, CISM, or CRISC.
• Strong risk reasoning, organization, documentation, ownership, communication, adaptability, and intellectual curiosity.
• Ability to work multiple days a week in M0's main hub office in NYC.