From the listing
About the role
This is a hands-on operator role where you will own the execution of Alpaca's ERM framework, including risk register hygiene and board-ready reporting. You will report to the CISO / ERM Lead and work closely with the ERM Working Group and local entity leaders.
You will update risk registers yourself, run functional risk lead check-ins, and produce board materials. The role involves managing intake from functional risk leads and residual scoring with risk owners without direct reports.
What you'll do
- Run the ERM intake cycle end to end including ticket ingestion, functional interviews, and surveys.
- Maintain functional and enterprise risk registers in Vanta.
- Coordinate functional risk lead check-ins and normalize inputs into the enterprise view.
- Map risks to L1 categories and L2 subcategories to enterprise scenarios for reporting.
- Apply the ERM Risk Scoring Model and push residual validation with risk owners.
- Track mitigation plans, action owners, target dates, and escalations.
- Define KRIs with data owners and use proxy metrics where instrumentation is maturing.
- Produce leadership and board ERM materials and support ERM Working Group agendas.
- Operate the intake triage workflow including scoring, deduping, and register action.
- Build playbooks and templates for functional leads.
- Surface emerging risks such as crypto, AI, and multi-jurisdiction for review.
What they're looking for
- 5 to 10 years in operational risk, ERM, GRC, or compliance program management at a regulated financial institution.
- Experience building or running a risk register from intake through reporting.
- Ability to coordinate Legal, Compliance, Finance, Product, Security, and Operations stakeholders.
- Hands-on GRC platform experience.
- Clear writing for risk statements, executive summaries, and board-ready tables.
- SEC/FINRA familiarity or equivalent regulated-environment experience.
Nice to have
- Broker-dealer, clearing, or custody operations context.
- High-growth fintech experience scaling ERM.
- Crypto / digital assets risk register exposure.
- Multi-entity, multi-jurisdiction risk consolidation.
- Jira service desk or structured intake workflow design.
- COSO ERM / ISO 31000 implementation as an operator.
- Prior work drafting board or risk committee reporting.
From the company page
Alpaca benefits
◉ Remote policy · in their words
“Our teams are not just global, we’re also 100% remote and have team members in almost every time zone and continent (except Antarctica).”
Pulled from their careers page · verified by Atlas
The hot takeJeff's read on Alpaca
I like their clear views on the value of remote work, check out this quote from their careers page:
> "Our teams are not just global, we're also 100% remote and have team members in almost every time zone and continent (except Antarctica). By joining Alpaca you'll be part of a multicultural, international organization."
I also like that their Glassdoor scores are going up (now 3.7/5), and they have some solid testimonials. I'm a LITTLE wary of this statement that gives me a bit of a "hustle culture" vibe:
> "We're keen on that last 10% of effort and believe that the details do matter. If this sounds like you, then you're in the right place."