Head of Information Technology (IT)

Position Overview

We are seeking an experienced, security-focused Head of Information Technology to establish, lead, and manage the IT function of a newly established financial services company in the United States.

The successful candidate will be responsible for designing, implementing, and maintaining a secure, resilient, scalable, and cost-effective technology infrastructure that supports the company’s business operations on a 24/7/365 basis.

This individual will build the IT organization from the ground up, including selecting technology vendors and cloud service providers, establishing cybersecurity policies and procedures, implementing secure employee computing environments, and recruiting and managing the IT team.

The ideal candidate combines strong technical expertise with practical leadership skills and an understanding of the security, availability, confidentiality, and regulatory requirements associated with financial services. The candidate must be comfortable taking a hands-on approach in the early stages of the company’s development while building systems and processes that can scale as the business grows.

Key Responsibilities

1. IT Strategy and Infrastructure Development

• Develop and execute the company’s IT strategy, infrastructure roadmap, and technology architecture in alignment with business objectives.
• Establish the IT function, technology standards, operating procedures, and governance framework from inception.
• Evaluate, select, and manage hardware, software, cloud platforms, networking solutions, and technology service providers.
• Design an infrastructure that supports secure, uninterrupted business operations 24 hours a day, 7 days a week, 365 days a year.
• Establish IT budgets, manage technology costs, and ensure efficient use of resources.
• Maintain comprehensive documentation of infrastructure, systems, configurations, access controls, and operating procedures.

2. Cloud Infrastructure and High Availability

• Evaluate and select appropriate cloud infrastructure providers and services, such as AWS, Microsoft Azure, or Google Cloud, based on business requirements, security, scalability, resilience, and cost.
• Design and implement highly available, fault-tolerant infrastructure with appropriate redundancy across systems, networks, storage, and availability zones or regions where justified.
• Establish disaster recovery and business continuity capabilities to minimize downtime and data loss.
• Define and implement recovery time objectives (RTO) and recovery point objectives (RPO) in consultation with business stakeholders.
• Implement infrastructure monitoring, alerting, incident management, capacity planning, automated backups, and recovery testing.
• Establish secure cloud configurations, identity and access management, encryption, network segmentation, and configuration management.
• Develop procedures for patching, system upgrades, vulnerability remediation, and infrastructure changes.
• Ensure that infrastructure architecture and cloud service agreements support the company’s operational availability requirements.

3. Cybersecurity and Information Security

• Own the implementation and ongoing management of the company’s IT security program.
• Establish and enforce security policies covering access management, passwords, multifactor authentication (MFA), data protection, acceptable use, remote access, and incident response.
• Implement a defense-in-depth security architecture covering endpoints, networks, servers, cloud services, applications, and corporate data.
• Establish identity and access management practices, including least-privilege access, role-based permissions, privileged access controls, and periodic access reviews.
• Implement endpoint detection and response (EDR), anti-malware protection, device encryption, firewalls, intrusion detection, and other appropriate security controls.
• Conduct or coordinate vulnerability assessments, penetration testing, security reviews, and remediation activities.
• Establish security logging, centralized monitoring, alerting, and incident investigation procedures.
• Develop and maintain an incident response plan covering cyberattacks, ransomware, unauthorized access, data breaches, and service disruptions.
• Coordinate security audits, risk assessments, and remediation of identified weaknesses.
• Manage relationships with external cybersecurity specialists, managed security service providers, and incident response partners as needed.

4. Employee Computer and Endpoint Security

• Establish and manage a secure computing environment for all employee laptops, desktops, and mobile devices.
• Implement centralized endpoint management and device configuration using appropriate tools, such as Microsoft Intune or equivalent solutions.
• Enforce full-disk encryption, endpoint protection, automatic security updates, secure configuration baselines, and screen-lock policies.
• Implement MFA, single sign-on (SSO), conditional access, and secure remote access wherever appropriate.
• Restrict local administrator privileges and control the installation of unauthorized software.
• Establish secure provisioning and deprovisioning procedures for employees, contractors, and third-party personnel.
• Ensure prompt revocation of access and recovery or remote wiping of company devices when employees or contractors leave.
• Implement email security, phishing protection, spam filtering, and employee cybersecurity awareness training.
• Establish appropriate controls for personally owned devices, if permitted, and prevent unauthorized access to company systems and information.
• Develop and enforce policies governing the use of removable media, file sharing, cloud storage, and confidential information.

5. Business Continuity and Disaster Recovery

• Develop and maintain IT business continuity and disaster recovery plans.
• Design redundancy and recovery procedures for critical infrastructure, business applications, communications, and data.
• Implement regular, protected backups, including appropriate offline or immutable backup capabilities.
• Test backup restoration, disaster recovery, and failover procedures on a scheduled basis.
• Establish service availability targets, incident escalation procedures, and operational recovery priorities.
• Coordinate with business leaders to identify critical services, acceptable downtime, and recovery priorities.
• Maintain procedures for responding to cloud provider outages, cybersecurity incidents, hardware failures, and network disruptions.

6. IT Team Building and Vendor Management

• Recruit, hire, develop, and manage the IT team required to support the company’s operations and growth.
• Define team structure, job responsibilities, staffing requirements, and escalation responsibilities.
• Determine which capabilities should be delivered internally and which should be outsourced to specialist service providers.
• Build relationships with cloud providers, cybersecurity firms, managed IT service providers, telecom providers, and other technology partners.
• Establish vendor selection criteria, service-level agreements (SLAs), performance metrics, and escalation processes.
• Manage vendor performance, contracts, technology budgets, and service quality.
• Develop a culture of accountability, security awareness, operational excellence, and continuous improvement.

7. Financial Services Risk and Regulatory Support

• Understand the technology risk and cybersecurity expectations applicable to U.S. financial services businesses.
• Establish appropriate IT controls for confidentiality, integrity, availability, auditability, and protection of customer information.
• Support compliance with applicable federal and state requirements, contractual obligations, and relevant industry standards.
• Maintain evidence of security controls, access reviews, system changes, backup testing, incident handling, and risk remediation.
• Work with legal, compliance, risk management, and external auditors to address technology-related obligations.
• Assess the security and operational risks of third-party technology providers and cloud services.
• Support the development of policies and controls aligned with relevant frameworks, such as the NIST Cybersecurity Framework, as appropriate to the company’s business and regulatory profile.

Specific regulatory obligations will depend on the company’s financial activities, legal structure, customers, and regulatory status.

8. IT Operations and Service Management

• Establish reliable processes for IT support, incident management, problem management, and change management.
• Implement monitoring and alerting to identify infrastructure issues before they significantly affect business operations.
• Ensure critical technology services have appropriate support coverage and escalation arrangements outside normal business hours.
• Establish service desk procedures and service-level targets for employee support.
• Manage software licensing, hardware inventory, asset lifecycle, system patching, and configuration records.
• Provide regular reports to executive management on availability, security risks, incidents, costs, and technology priorities.

Required Qualifications & Experience

• Minimum of 5 years of professional IT experience within the financial services industry, such as banking, payments, brokerage, investment management, fintech, lending, or a related business.
• Demonstrated experience designing, implementing, or managing secure IT infrastructure in a business environment.
• Practical knowledge of cloud platforms such as AWS, Microsoft Azure, or Google Cloud.
• Experience with high-availability architecture, fault tolerance, backup and recovery, disaster recovery, and business continuity.
• Strong understanding of cybersecurity principles, network security, identity management, endpoint protection, encryption, and vulnerability management.
• Hands-on experience securing employee laptops, desktops, email systems, and remote working environments.
• Experience selecting technology vendors and managing external IT or cybersecurity service providers.
• Demonstrated ability to recruit, build, and manage an IT team.
• Experience developing IT policies, operating procedures, security standards, and infrastructure documentation.
• Understanding of IT risk management, audit requirements, and the protection of confidential financial and customer information.
• Strong analytical, troubleshooting, project management, communication, and leadership skills.
• Ability to work independently and make sound technical and business decisions in a startup environment.

Preferred Qualifications

• Experience building an IT department or technology infrastructure for a startup, fintech, or newly established financial services company.
• Relevant certifications, such as CISSP, CISM, CCSP, AWS Certified Solutions Architect, or Microsoft Azure security certifications.
• Familiarity with NIST Cybersecurity Framework, SOC 2 controls, ISO 27001, and other relevant security standards.
• Experience with endpoint management, EDR/XDR, SIEM, identity providers, and cloud security posture management tools.
• Experience supporting regulatory examinations, independent security assessments, and third-party risk reviews.
• Experience managing outsourced 24/7 IT operations or security monitoring services.

Key Performance Indicators (KPIs)

The Head of IT will be evaluated against measurable objectives, including:

• Service availability: Achievement of approved uptime targets for critical business systems.
• Security posture: Timely remediation of critical vulnerabilities and implementation of required security controls.
• Endpoint security: Percentage of company devices enrolled in centralized management and compliant with security policies.
• Access management: Timely provisioning, deprovisioning, and periodic review of user access.
• Disaster recovery: Successful completion of scheduled backup restoration and disaster recovery tests against approved RTO and RPO targets.
• Incident response: Timely detection, escalation, investigation, and resolution of IT and security incidents.
• Audit readiness: Timely completion of IT control documentation, evidence collection, and remediation activities.
• Team development: Successful recruitment and development of the IT team according to the approved hiring plan.
• Cost management: Delivery of reliable, secure infrastructure within the approved technology budget.

Personal Attributes

The successful candidate will be:

• Security-conscious and risk-aware.
• Hands-on, practical, and comfortable operating in a startup environment.
• Capable of translating business needs into reliable technology solutions.
• Proactive in identifying and addressing security and operational risks.
• Able to balance security, availability, scalability, and cost.
• An effective communicator who can work with executives, employees, external vendors, auditors, and regulators.
• Comfortable taking ownership and building processes where none currently exist.

What We Offer

An opportunity to build the IT and cybersecurity foundation of a new financial services company, select its core technology platforms, establish secure operating practices, and develop a technology organization that supports the company’s long-term growth.

The successful candidate will have meaningful responsibility for technology strategy, infrastructure architecture, security, vendor selection, team development, and operational resilience.

Application Requirements

Interested candidates should provide a résumé outlining their financial services IT experience, cloud infrastructure and cybersecurity expertise, experience building or managing IT teams, and examples of infrastructure or security initiatives they have successfully delivered.