---
title: 'Sr. Security Engineer - GRC APAC Fintech & Financial Services at xAI'
canonical: 'https://feeny.ai/job/sr-security-engineer-grc-apac-fintech-financial-services-xai-tokyo-b9tfgbgv944a'
type: 'job'
last_seen: '2026-10-12'
---

# Sr. Security Engineer - GRC APAC Fintech & Financial Services at xAI

- **Company:** xAI
- **Location:** Tokyo, Japan
- **Posted:** 2026-10-09
- **Last confirmed live:** 2026-10-12
- **Apply:** https://job-boards.greenhouse.io/xai/jobs/5261818007

## Job description

SpaceX was founded under the belief that a future where humanity is out exploring the stars is fundamentally more exciting than one where we are not. Today, SpaceX is actively developing the technologies to make this possible, with the ultimate goal of making life multiplanetary and expanding consciousness to the stars.

SpaceXSI is building Super Intelligence to understand the universe and help expand humanity’s knowledge and capabilities. We work across the full Super Intelligence stack: compute (Colossus supercomputers), models (Grok), and applications (Grok Bot, Grok Build, Grok Imagine, Grok Voice, and X). We're creating a powerful flywheel where more compute trains better models, better models power more useful products, and what we learn from people using those products shapes what we build next.

## ABOUT THE ROLE:

We are seeking an experienced Governance, Risk, and Compliance (GRC) Engineer focused on Japanese information security and financial services regulation to help scale compliance for SpaceXAI and X Money. As we expand deeper into the regulated Japanese market, maintaining a robust, transparent, and technically sound information security GRC program is critical. You will architect the systems and processes that automate trust — a pragmatic operator who understands that GRC exists to enable the business, balancing rigorous standards with the velocity of a high-growth company. The ideal candidate brings hands-on experience with JFSA supervisory expectations, APPI, and local Japanese banking and payments technology controls, plus GRC engineering skills: Compliance-as-Code, continuous evidence collection, and deep partnership with engineering so controls are designed into the platform rather than bolted on after the fact. This role may also include additional tasks and responsibilities as needed to support the team and evolving business priorities. This position may require occasional travel.

## RESPONSIBILITIES:

- Own and evolve Japan financial services and payments compliance posture across JFSA supervisory expectations (including technology risk management, incident reporting, and third-party technology risk), APPI, and local Japanese banking and payments technology controls supporting X Money.
- Build and maintain Compliance-as-Code capabilities — policy-as-code, automated control validation, continuous evidence collection, and monitoring integrated into CI/CD — so audit and supervisory readiness scales with the business rather than depending on manual, point-in-time checks.
- Operate and extend GRC platforms (e.g., Vanta) as the backbone for control mapping, evidence management, and continuous compliance; integrate with cloud, identity, logging, and engineering systems to reduce administrative bottlenecks.
- Partner with Architects and Engineering Leads to bake JFSA and APPI requirements into design early; translate complex Japanese regulatory obligations into concrete technical implementations and auditor- or supervisor-ready narratives without slowing development.
- Design, implement, and validate technical controls relevant to Japanese banking and payments environments (access control, logging and monitoring, encryption, change management, vulnerability management, business continuity and disaster recovery, and secure SDLC) — not just document them.
- Operate the cybersecurity and compliance risk register — identify, quantify, and track risks, distinguishing theoretical gaps from meaningful business and regulatory risk under JFSA supervisory expectations.
- Lead risk assessments and compliance reviews for new products, payment flows, features, vendors, and architectural changes that affect the Japan regulated attack surface, including third-party technology risk and subcontractor/sub-processor oversight.
- Liaise with Legal and the Data Privacy team on security-relevant intersections with APPI, including security measures for personal data and breach/incident reporting aligned to applicable JFSA expectations.
- Own and cultivate relationships with external auditors, assessors, and (where applicable) JFSA supervisory contacts; serve as the bridge between external parties and internal teams so requests are reasonable, clear, and relevant to our stack.
- Develop, maintain, and continuously improve policies, standards, and procedures aligned to JFSA, APPI, and local banking and payments technology requirements, mapped to the control library shared with US Fintech to avoid duplicate control sets.
- Champion pragmatic governance — prioritize issues that represent real security or business risk over checkbox compliance.

## BASIC QUALIFICATIONS:

- Bachelor's degree in computer science, Information Security, Cybersecurity, risk management, or an engineering/STEM field — or equivalent practical experience.
- 8+ years of experience owning or materially operating a GRC, information security compliance, or ISMS program in fintech, banking, payments, SaaS, or other regulated technology environments — with primary Japan exposure.
- Demonstrable experience owning or materially operating an ISMS and control library, and experience supporting client security assurance, external audits, or regulatory evidence processes.
- Hands-on experience with JFSA supervisory expectations and local Japanese banking and payments technology controls — including implementing or operating controls, not only reading the requirements.
- Strong understanding of information security risk management, control assessment, risk treatment, and governance reporting to senior stakeholders.
- Experience coordinating security incident response governance (escalation, communications, remediation tracking) and operating or improving supplier/third-party security assurance.
- Working knowledge of APPI sufficient to partner with Privacy counterparts on security of personal data and incident support.
- Technical fluency to partner with Engineering on cloud (AWS/GCP/Azure), identity, logging, and secure SDLC — and to evaluate control objectives against real configurations.

## PREFERRED SKILLS AND EXPERIENCE:

- 10+ years of information security compliance, GRC engineering, or technology audit experience in fintech or financial services with a primary Japan focus.
- Experience in a SaaS, fintech, financial services, regulated technology, or B2B enterprise software environment.
- Hands-on experience implementing technical controls (IAM, logging/monitoring, encryption, hardening) and integrating compliance checks into CI/CD / DevSecOps pipelines.
- Familiarity with secure SDLC practices: threat modeling, SAST/DAST, dependency scanning, secrets management, application/API penetration testing, and vulnerability remediation tracking.
- Deep familiarity with JFSA expectations for technology risk management, third-party technology risk, and incident reporting at banking and payments providers.
- Experience enabling enterprise sales through trust centers, vendor questionnaires, client audits, and contractual security schedules for clients in Japan.
- Experience mapping a single control library shared across jurisdictions (e.g., US Fintech and Japan) so JFSA, APPI, and local banking and payments technology requirements are met without duplicate control sets.
- Experience supporting BC/DR and resilience evidence (dependency mapping, backup/restore testing, RTO/RPO validation).
- Proven ability to operate a risk register and apply judgment in gray areas — focusing on outcomes over optics.
- Excellent communication and stakeholder management — able to explain risk and tradeoffs to engineers, legal, privacy, sales, and executives in plain language.
- Certifications such as CISSP, CISM, CISA, CRISC, or equivalent preferred.
- Prior experience working with or within JFSA-supervised financial institutions, banking or payments providers, or supervised fintechs in Japan is a plus.
- Based in Japan; fluency in English required; Japanese language proficiency a plus.

SpaceXAI is an equal opportunity employer. For details on data processing, view our [Recruitment Privacy Notice](https://x.ai/legal/recruitment-privacy-notice).

## About xAI

## Company Overview
- **One‑liner**: xAI builds artificial intelligence systems to accelerate human scientific discovery and “understand the universe,” with products spanning frontier reasoning models, real‑time voice, and generative media.
- **Entity Type**: Private (last funding round: Series E, January 2026; acquired by SpaceX in February 2026)
- **Headquarters**: Palo Alto, California, USA (additional offices in Seattle, WA; Memphis, TN; London, UK)
- **Founded**: 2023
- **Founders**: Elon Musk

## Core Business
- Primary industry: Artificial Intelligence (AI research, large language models, voice AI, generative media)
- Target customers: B2B (developers via API), B2C (consumers via Grok on 𝕏, SuperGrok subscriptions), Enterprise & Government (xAI for Government)
- Mission: “To understand the universe” – building AI that extends what humanity can know and do.

## Products & Services
- **Grok (base models)** : A conversational AI assistant modeled after *The Hitchhiker’s Guide to the Galaxy*, available on the 𝕏 platform and via API.
- **Grok 4 / Grok 4 Heavy**: The most intelligent reasoning models, featuring native tool use and real‑time search integration (SuperGrok and Premium+ tiers).
- **Grok Voice Agent API / Voice Agent Builder**: Create custom voice agents in under two minutes (no‑code) – includes speech‑to‑text, text‑to‑speech, custom voice cloning, and multilingual support.
- **Grok Imagine API**: State‑of‑the‑art video generation API (quality, cost, latency).
- **Grok‑1.5 / Grok‑2 / Grok‑2 mini**: Earlier model releases with improved reasoning and 128K context length.
- **PromptIDE**: An integrated development environment for prompt engineering and interpretability research.
- **xAI for Government**: A suite of frontier AI products tailored for U.S. government customers.
- **Colossus Supercomputer**: 200,000‑GPU cluster built in 122 days, used for training xAI models; now also leased to Anthropic (Colossus 1 agreement).

All products are delivered as SaaS, API, and model weights (open‑source release of Grok‑1).

## Market Standing
- **Valuation / Funding**: 
  - Series B (May 2024): $6 B 
  - Series C (Dec 2024): $6 B (led by A16Z, BlackRock, Fidelity, Kingdom Holdings, Lightspeed, MGX, Morgan Stanley, OIA, QIA, Sequoia, Valor, Vy Capital, others)
  - Series E (Jan 2026): $20 B
  - Acquisition by SpaceX announced Feb 2, 2026 (terms not disclosed).
- **Key Metric**: Total disclosed funding ~$32 B; annual revenue not publicly available.
- **Notable Investors/Partners**: A16Z, BlackRock, Fidelity, Sequoia Capital, Morgan Stanley, Kingdom Holdings, Lightspeed, MGX, Valor Equity Partners, Vy Capital, Anthropic (Colossus deal), U.S. Department of War (selected Dec 2025).
- **Growth Signals**: 
  - Rapid scaling from founding to 200K‑GPU cluster in 122 days.
  - Over 214 open roles listed on Greenhouse as of mid‑2026.
  - #1 on Big Bench Audio (Grok 4 audio performance).
  - Expanded into voice agents, video generation, and government verticals within 3 years.
  - Acquisition by SpaceX signals deep integration with space‑tech resources.

## Competitive Advantages
- **Compute infrastructure**: Colossus supercomputer – one of the largest GPU clusters in existence, enabling faster training and larger models.
- **Model performance**: Grok 4 claims “most intelligent model in the world” with top benchmarks (Big Bench Audio #1).
- **Vertical integration**: Tight coupling with 𝕏 platform for data, distribution, and real‑time world knowledge.
- **Speed of execution**: “Move quickly and fix things” culture; built Colossus in 122 days.
- **Government contracts**: Early access to public‑sector AI markets (U.S. Department of War).
- **Talent density**: Small, focused team of researchers and engineers; in‑person work accelerates iteration.

## Strategic Focus
- **Continue advancing frontier reasoning** (Grok 4 Heavy, next‑gen models).
- **Expand voice and multimodal APIs** for developers (Voice Agent Builder, Custom Voices Library).
- **Deepen government / defense partnerships** (xAI for Government, Department of War).
- **Scale infrastructure** post‑acquisition via SpaceX resources.
- **Remain “open” where strategic** (open‑source release of Grok‑1 weights).

## Why Work Here
- **Culture**: “Ambitious goals, fast execution” – rejects consensus in favor of first‑principles reasoning. In‑person work prioritized (Palo Alto, Seattle, Memphis, London).
- **Benefits**: 
  - Competitive cash + equity compensation.
  - Comprehensive medical, dental, vision, disability, life insurance.
  - 401(k) plan, fertility benefits, flexible vacation.
  - Visa sponsorship offered.
- **Engineering culture**: No recruiters for assessments – applications reviewed directly by technical team. Interview process: application → screening → technical interviews → offer.
- **Mission‑driven**: Opportunity to work on frontier AI models that aim to “advance humanity.”
- **Perks**: In‑person collaboration, fast‑paced environment, ownership of meaningful projects.

## Sources
1. [x.ai/company](https://x.ai/company)
2. [x.ai/careers](https://x.ai/careers)
3. [job-boards.greenhouse.io/xai](https://job-boards.greenhouse.io/xai)
4. [x.ai/news](https://x.ai/news)
5. [x.ai/careers/open-roles](https://x.ai/careers/open-roles)

## Other roles at xAI

- [Infrastructure Security Engineer (Bare Metal & Platform)](https://feeny.ai/job/infrastructure-security-engineer-bare-metal-platform-xai-palo-alto-1m5yd1r4x002) — Palo Alto, CA / Austin, TX / New York, NY / Seattle, WA
- [Construction Manager, Power Generation - Memphis](https://feeny.ai/job/construction-manager-power-generation-memphis-xai-southaven-j2yyjy4vdr1r) — Southaven, MS / Memphis, TN
- [Construction Superintendent, Power Generation - Memphis](https://feeny.ai/job/construction-superintendent-power-generation-memphis-xai-southaven-gbmdp60g0exm) — Southaven, MS / Memphis, TN
- [Architect (Data Centers & Workplace) - Memphis](https://feeny.ai/job/architect-data-centers-workplace-memphis-xai-southaven-6hs4a4x1tz1n) — Southaven, MS / Memphis, TN
- [HR Coordinator](https://feeny.ai/job/hr-coordinator-xai-southaven-59kwbbt7awjy) — Southaven, MS / Memphis, TN
- [Team Lead, Human Data Operations - Vision, Image & Video](https://feeny.ai/job/team-lead-human-data-operations-vision-image-video-xai-palo-alto-ys8argd3gz8c) — Palo Alto, CA / Asia / Australia / Canada / Europe / Global / United States
- [Data Center Manager](https://feeny.ai/job/data-center-manager-xai-southaven-krjtp4n0c5p0) — Southaven, MS / Memphis, TN
- [Data Center Operations Supervisor](https://feeny.ai/job/data-center-operations-supervisor-xai-memphis-0adr9mddjzb0) — Memphis, TN
- [Driver (CDL) - Memphis (Night Shift)](https://feeny.ai/job/driver-cdl-memphis-night-shift-xai-southaven-ntx1dknzjgmf) — Southaven, MS / Memphis, TN
- [Sr. Manager, Commercial Sales (Starlink Mobile)](https://feeny.ai/job/sr-manager-commercial-sales-starlink-mobile-xai-madrid-daghpt9c52am) — Madrid, Spain