Lead, Security GRC (Compliance)

About the Company

Gemini is a global crypto and Web3 platform founded by Cameron and Tyler Winklevoss in 2014, offering a wide range of simple, reliable, and secure crypto products and services to individuals and institutions in over 70 countries. Our mission is to unlock the next era of financial, creative, and personal freedom by providing trusted access to the decentralized future. We envision a world where crypto reshapes the global financial system, internet, and money to create greater choice, independence, and opportunity for all — bridging traditional finance with the emerging cryptoeconomy in a way that is more open, fair, and secure. As a publicly traded company, Gemini is poised to accelerate this vision with greater scale, reach, and impact.

The Department: Security Governance, Risk & Compliance (GRC)

The Role: Lead, Security GRC (Compliance)

Gemini is seeking a Security GRC Lead to manage and be accountable for the organization’s security compliance programs, including PCI, ISO 27001, NYDFS, and SOC II reports. This leadership role requires strong project management skills, executive-level communication abilities. The ideal candidate will have a proven track record in regulatory compliance enforcement, security process development, policy creation, and security framework navigation. Experience with a Big 4 firm is highly desirable, but equivalent experience in leading security compliance teams in financial services, technology firms, or regulated industries will also be considered.

The role demands deep expertise in security compliance frameworks, audit preparedness, and regulatory reporting, ensuring the organization adheres to all necessary cybersecurity compliance standards. The Security GRC Lead will work closely with internal stakeholders to establish, implement, and maintain best-in-class compliance programs that meet evolving industry regulations.

This is a full-time position, requiring the ability to influence, drive strategy, and provide mentorship within the security governance space.

This role is required to be in person twice a week at either our San Francisco, CA or New York City, NY office.

Responsibilities:

• Ownership & Accountability: Lead, manage, and be accountable for PCI, ISO 27001, NYDFS, and SOC II compliance programs.
• Audit Planning & Execution: Develop and oversee project plans for internal and external audits, ensuring timely execution and alignment with compliance requirements.
• Operational Excellence: Drive continuous improvement in security compliance operations by implementing efficient and scalable processes.
• Regulatory & Audit Coordination: Oversee security audits, and regulatory compliance initiatives.
• Automation & Efficiency: In partnership with technology teams, assist in streamlining evidence collection, automate security enforcement, and optimize compliance workflows.
• Leadership & Team Development: Mentor and guide a team, fostering a strong risk management culture and ensuring best practices.
• Executive Communication: Present compliance status, risk assessments, and mitigation strategies to senior leadership.
• Cross-functional Collaboration: Align compliance goals with business objectives and coordinate efforts across multiple teams.

Minimum Qualifications:

• Bachelor’s degree and equivalent practical experience in cybersecurity compliance risk management.
• Minimum of 8 years of experience in cybersecurity compliance with a focus on regulatory frameworks.
• Proven expertise in managing NYDFS, PCI, ISO 27001, and SOC II compliance.
• Exceptional project management skills, with the ability to prioritize and balance multiple initiatives effectively.
• Strong analytical, problem-solving, and communication skills, capable of interfacing with senior executives.