Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 4 hours agoWe saw it 89 min after it went up

Information Security Lead — Nova Credit

General Catalyst portfolio6,357 open roles

Pay
$118,400 – $140,600 a year
Where
New York, NY, USA
Work mode
On site
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowInformation Security Lead — Nova CreditGeneral Catalyst portfolio · New York, NY, USA

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on General Catalyst portfolio's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

9.8% of postings close within 7 days. Measured by our own scanner across the market. General Catalyst portfolio postings stay open a median of 28 days.

Share of postings closed within
  1. 1.9%1 day
  2. 3.9%3 days
  3. 9.8%7 days
  4. 15.6%14 days
  5. 33.8%30 days
This job: posted 4 hours ago

General Catalyst portfolio median: 28 days open

The posting

Nova Credit is a credit infrastructure and analytics company that enables businesses to grow responsibly by harnessing alternative credit data. The company leverages its unique data infrastructure, industry-leading analytics & FCRA-compliance to help lenders fill in the gaps that exist in traditional credit analytics. Nova Credit provides access to the fragmented universe of consumer financial data and transforms it into compliant, actionable risk analytics through a suite of solutions designed to increase conversion through expanded coverage, speed, and reliability. Nova Credit supports over 7,000 businesses including organizations such as HSBC, SoFi, Scotiabank, AppFolio, and Yardi, who work with Nova Credit to make smarter credit decisions through cash flow underwriting with Cash Atlas™, quickly and accurately verify income with Income Navigator, verify income and assets with Eligibility Compass, and reach new-to-country consumers with Credit Passport®. We were named in Forbes’ Fintech 50 in 2025 and Built In’s Best Places to Work, 2025.

As Nova Credit’s Information Security Lead, you will be a hands-on, all-rounder security practitioner at the heart of our InfoSec function. You will partner closely with the Director of Information Security to mature our security program, moving fluidly between deep-in-the-weeds technical work (configuring tooling, hardening systems, investigating alerts, automating controls) and the Governance, Risk, and Compliance (GRC) work that earns us the trust of some of the world’s largest financial institutions (responding to customer security questionnaires, supporting SOC 2 and ISO 27001 audits, executing on our control sets, and running third-party risk reviews).

This role is built for someone who is happy doing both. You bring an engineer’s instinct for solving security problems with configuration, and the practitioner’s patience for the questionnaire and audit work that proves out our controls. You will work cross-functionally with the rest of the company, while you will own meaningful technical and program-level initiatives from your first quarter.

This is a hybrid role (3 days per week in office on Mondays, Tuesdays, and Thursdays) based in the New York City Metropolitan area.

WITHIN THE FIRST MONTH, YOU'LL:

  • Develop a working understanding of Nova Credit’s products, our AWS-based infrastructure, and the data flows that matter most from a security perspective.
  • Familiarize yourself with our control sets, frameworks, and policies (SOC 2 Type II, ISO 27001, internal standards) and our existing inventory of customer-facing security commitments.
  • Get hands-on with our security tooling stack, EDR, MDM, SSO/IAM, DLP, cloud security posture management, etc.
  • Shadow incoming customer security questionnaires and due diligence reviews to learn the cadence, the source-of-truth artifacts, and our standard responses.
  • Pick up your first hands-on tickets, things like endpoint hardening, MDM tuning, IAM cleanup, or evidence collection, to build operational muscle memory.
  • Meet your stakeholders across the rest of the company.

WITHIN THE FIRST QUARTER, YOU'LL:

  • Start to own customer security questionnaires and due diligence reviews end-to-end, from intake, to evidence pulls, to clean responses, to the follow-up calls.
  • Configure, tune, and operate security tooling across our stack (EDR, MDM, SSO/IAM, DLP, Google Workspace settings).
  • Triage and respond to security alerts, bug bounty reports, and internal escalations; document repeatable response runbooks for what you handle.
  • Contribute to third-party risk reviews of new vendors and re-reviews of existing critical suppliers.
  • Surface and propose fixes for at least one process gap or control weakness you identify during onboarding.

WITHIN THE FIRST YEAR, YOU'LL:

  • Own an agreed-on slice of Nova Credit’s security program end-to-end, e.g., IAM/SSO, endpoint and MDM, vulnerability management, customer-trust/questionnaire program, or third-party risk, with clear, measurable outcomes.
  • Own customer security questionnaires and due diligence reviews end-to-end, from intake to evidence pulls, to clean responses, and attending follow-up calls.
  • Drive at least one significant hardening or modernization initiative
  • Be a go-to internal expert for technical security questions from Engineering, Product and Data Science
  • Partner with the Director of Information Security on roadmap, prioritization, and how our Information Security program scales as Nova grows

YOUR SKILLSET:

  • Experience: 3–6+ years across information security, security engineering, cloud security, or technical GRC roles, ideally with at least some time in a high-growth fintech, financial services, or regulated SaaS environment.
  • Hands-on technical depth: Comfortable configuring and operating modern security tooling such asEDR, MDM, SSO/IAM, DLP, and cloud security tooling. Knowledge of Jamf, SentinelOne, Okta are a plus
  • Cloud security: Working knowledge of AWS security, IAM, networking, KMS, logging, and common misconfiguration risks. You can reason about real architecture and point out where the risks are.
  • Foundational concepts: Solid grasp of networking, identity, cryptography, secure SDLC, and web application security. You don’t need to be an offensive security specialist, but you should know how attackers think.
  • GRC / audit fluency: Direct experience with SOC 2 Type II and ISO 27001 are a plus.
  • Communication: You can explain a technical risk to engineering team members, write a clean policy, and disagree productively with an Engineering lead in the same week.
  • All-rounder mindset: You are equally willing to dig into a misconfigured IAM policy and fill out a 200-question bank questionnaire. You don’t silo the work into “technical” and “non-technical.”

$118,400 - 140,600 USD per year

The above compensation range is for United States-based candidates and is dependent on individual experience, skills, education, location, and qualifications. We consider all elements of compensation to be a part of the value we provide to Novans. This may include base salary, equity grants, incentive compensation for eligible roles, professional development, flexible PTO, and tenure rewards. In the U.S., our benefits package includes comprehensive and generously subsidized medical, dental, and vision insurance options, along with a company-sponsored 401k plan, parental leave of absence, sick time off, and paid time off vacation.

Everyone is welcome at Nova Credit. We are an equal-opportunity employer where diversity and inclusion are central pillars of our company strategy. We seek applicants who understand, embrace, and thrive in a multicultural and globalized world. We do not discriminate on the basis of any protected class, including race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, or disability status. We encourage all qualified candidates, including those with a criminal history, to apply.

Before submitting your application, please review our Applicant Privacy Notice to learn how we collect, use, and protect your personal information during the application process.

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against General Catalyst portfolio's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on General Catalyst portfolio's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    General Catalyst portfolio's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.