Deputy Chief Information Security Officer

Mercury is a fintech company, not an FDIC-insured bank. Banking services provided through Choice Financial Group and Column N.A., Members FDIC.

• Bank-entity 2LOD InfoSec program: Governance, policy, risk, and oversight scoped to the chartered bank.
• Examiner posture: OCC, FFIEC, FDIC and FRB examiner inquiries; ownership of the examiner-ready narrative; coordination of the evidence.
• FFIEC control remediation: Lead remediation of identified FFIEC IT control deficiencies to charter readiness ahead of the OCC pre-opening examination.
• Policy architecture: Carry the bank-scoped policy stack (Policy / Standard / Procedure), including ratification cycles, MRCC memos, and board approvals.
• BC/DR: Partner with the Chief Risk Officer on bank continuity, resilience, and recovery, including tabletop exercises and full-scale drills.
• Audit and assurance: Manage relationships with internal audit (3LOD) and external assessors (SOC 2, FFIEC CAT, regulator-led IT examinations).
• Third-party risk: Ensure TPRM evidence holds up to bank-grade scrutiny for critical service providers and material outsourcing arrangements.
• Team development: Coach and grow the GRC sub-team; run a recurring training cadence; build the bench depth a national bank requires.

• 8+ years in Information Security, with 3+ years inside a regulated bank, trust bank, or de novo bank charter effort. Mercury is a startup chartering a national bank — this experience is non-negotiable.
• Deep FFIEC and OCC fluency: You have deep working knowledge of the FFIEC CAT, the FFIEC IT Examination Handbook, BSA/AML IT supervisory expectations, and the OCC Heightened Standards.
• Direct examiner-facing experience: You have defended a control to an OCC, FDIC, or Federal Reserve examiner. You know what good evidence looks like before it gets challenged.
• Policy and standards craft: You can draft a board-ratifiable policy and the supporting standards stack that operationalizes intent, not just satisfies a checklist.
• Operating discipline: You run cadences, write status that survives executive review, and maintain currency of controls, evidence, and risk registers.
• 2LOD instinct: You understand the three-lines-of-defense model and have served in the oversight role.

• The total rewards package at Mercury includes base salary, equity (stock options/RSUs), and benefits. Our salary and equity ranges are highly competitive within the SaaS and fintech industry and are updated regularly using the most reliable compensation survey data for our industry. New hire offers are made based on a candidate’s experience, expertise, geographic location, and internal pay equity relative to peers.