Head of IT/Compliance

Footprint is the agentic platform that learns your compliance program and runs it end to end.

Compliance teams at banks and fintechs are drowning in financial crimes investigations. Transaction volumes are surging, regulators keep raising the bar, and the work still runs on manual review queues stitched together from legacy vendors. Percy, our agentic system, learns each team's procedures and makes the same calls their analysts would: clearing false positives, escalating real risk, writing the case narrative, and documenting every decision for audit. It cuts review workloads by 70%+.

The harder problem is underneath. Every investigation is grounded in the data sources compliance teams already trust, and every case commits to an organizational memory that compounds — so a pattern one analyst caught in March surfaces automatically in October, across KYC, EDD, sanctions, and monitoring. Whether the team is five analysts or 500, they share one brain. Every memory carries provenance. Agents propose; humans approve. That's four years of identity infrastructure sitting under the agent, and it's the part nobody can bolt on later.

We're backed by QED, Index, and Box Group, and trusted by FDIC- and OCC-regulated banks plus fintechs like Bilt, Nuvei, and MoonPay. We 5x'd revenue last year. The team is small, senior, and ships fast.

For four years, Footprint's security and compliance work has been the CTO's responsibility. SOC 2 Type 2, PCI DSS Level 1, GDPR, and ISO 27001 all got stood up and kept live. The internal systems underneath them got built the same way: SSO, device management, access control, and dozens of vendor relationships.

We are hiring this first dedicated IT and Compliance role early for two reasons. First, Footprint helps companies be compliant, so we hold ourselves to the highest standards here. Our customers are banks and fintechs who trust us with some of the most sensitive data there is, and proving we deserve that trust - security questionnaires, report requests, audits - is core to how we sell, not a cost center. Second, we believe our compliance program should push the frontier on what a secure organization touching this kind of data should be.

You're inheriting a real program with all four frameworks live and passing. We're in good health; we need you to take us to the next level. The mandate is to take a compliance program that passes its audits and build one that's ahead of them: vendor management, data lifecycle, endpoint coverage, and the system of record itself all become yours to systematize, and to keep pace with everything we're building next, including agentic systems. You'll own these decisions and have the trust and ownership to change how we approach this today.

You'll report directly to Alex Grinman, our CTO.

• The compliance programs. SOC 2 Type 2, PCI DSS Level 1, GDPR, and ISO 27001, with Vanta as the system of record. You own the control state, the evidence, and the audits with our external auditors. You also own the judgment underneath them: which findings we fix now, which risks we accept and document, and where an auditor's ask deserves an argument

• Identity and access. SSO, directory management, and the authentication and authorization policies behind them. Onboarding and offboarding run end to end through you, including the revocation path that has to be airtight the day someone leaves. You set the access standard for every internal service and tool we use

• The device fleet. Endpoint protection and device security across every workforce machine. You own the coverage standard, the tooling choices, and the enforcement model, and you defend them to the engineers who live inside them

• Technology vendors and spend. Dozens of tools, each carrying a security review, a SOC 2, ISO, or PCI risk report in Vanta, and a spend line. The vendor process is yours to design and own: the security and IT review on anything new we adopt, and the renew-or-cut calls on infrastructure spend

• Security and cloud operations. You own the relationship with our pentesters and scanning vendors, and their results as audit evidence. Workforce and vendor-stack alerts run through you to resolution. Cloud operations, and the documentation of how our infrastructure fits together. Disaster recovery and the data-lifecycle program, retention through deletion, are yours to own and to test on a schedule you set

• Compliance as something Sales can use. You own the customer-facing edge of the program: the report package Sales hands a prospect directly, and the hard answer on a security questionnaire when one comes back

Vanta · SSO and directory management · MDM and endpoint security · AWS · external auditors, pentesters, and continuous scanning

Deep experience with most of this, and the judgment to pick up the rest, is what matters.

• You've owned at least one compliance program end to end: scoped it, ran the audit with the auditor, and closed the findings yourself

• You've been the person accountable for control state in Vanta, Drata, or an equivalent platform

• You've run a workforce device fleet on a modern MDM and endpoint security stack

• You've owned SSO and directory management, including the offboarding path

• You've been the entire IT and compliance function at a company, with no specialist team behind you

• You've made a documented risk-acceptance call under real resource constraints and can walk through the reasoning

• You can explain a technical control to someone non-technical without jargon. You'll do it in the first conversation

• PCI DSS Level 1 program ownership. It's the scarcest piece of this scope and the hardest of our four frameworks to learn on the job

• An engineering background of any depth. You'll set access and device policy that engineers live inside every day, and it helps to have been on their side of it

• Fintech, payments, or another regulated environment. We're a company built on detecting and stopping financial crime, so knowing what a regulator actually asks for counts for a lot here

• You've built a compliance function from zero at a company under 200 people. That's the exact shape of this job

• Security and cryptography standards. To us, caring about this is an indicator that you're thoughtful about security

90 Days

• Endpoint coverage and control state across all four frameworks run to a standard you set, and you own the evidence for both

• Vendor management runs as a process you own, with reviews, risk reports, and spend all in one place

• Sales pulls a current compliance report from a package you maintain

• The 2026 GDPR and SOC 2 audits are underway with you running them, and Alex has stopped being the person IT and compliance decisions route through

1 Year

• Every compliance program runs on a calendar you own, with audit dates set a year out

• The data-lifecycle program and disaster recovery both run on a schedule you own and test

• Infrastructure and network documentation is maintained on a cadence you own

• New frameworks get adopted on a schedule we set

• You report vendor spend, control state, and time-to-close on vulnerability alerts as standing numbers

• Massive impact, fast: You'll work on projects that shape company direction, not analysis that gets shelved.

• Own meaningful work: From day one, you'll have direct ownership over strategic initiatives that drive the business forward.

• Real growth opportunity: Promotion timelines depend on performance: the harder you work, the quicker you'll get promoted.

• Winning team and culture: We're a fast-moving, no-BS team that likes to win (and have fun doing it).

• 💰 Generous compensation and equity packages

• 🍽 Free lunch and dinner (after 7pm)

• 💪 Monthly wellness stipend

• 🏖 Unlimited PTO

• 🏥 Fully covered health, dental, and vision insurance

• 🚀 The chance to help shape the future of internet identity and financial crime prevention