Head of Legal & CCO

Job Description: We are seeking a hands-on, strategic Head of Legal & Chief Compliance Officer (CCO) to own and scale our compliance program as we grow. In a legal capacity, you will own the company's commercial, corporate, and operational legal needs, drafting and negotiating customer and vendor contracts, supporting corporate and financing matters, and serving as the first internal point of contact for legal questions across the business, scaling the function from a largely outside-counsel model into a practice that grows with the company. As the firm’s CCO, you will serve as the primary interface with regulators, internal stakeholders, and external partners regarding all aspects of regulatory compliance. You will also own the firm's SOC 2 Type 2 program end-to-end, serving as the accountable executive for achieving and maintaining the attestation, including scoping, control design, evidence collection, auditor management, and continuous monitoring across the annual observation period. You will develop, maintain, and oversee the firm's compliance policies, processes, and training programs to ensure that we meet all regulatory requirements and uphold the highest ethical standards. This is a unique opportunity to build and evolve a best-in-class legal and compliance program at the intersection of wealth management and technology.

General Legal Support: Draft, negotiate, and manage customer agreements, including platform/SaaS subscription agreements, master service agreements, order forms, and SOWs with prospective and existing advisor and RIA clients. Build and maintain a library of standardized contract templates. Review and negotiate vendor, supplier, and partner agreements, including market data providers, custodians, cloud infrastructure, and SaaS tooling, balancing commercial terms against legal and operational risk. Manage NDAs, data processing agreements, and licensing arrangements across the customer and vendor base. Support corporate matters including financing rounds, equity and option administration, board and stockholder materials, and entity management, coordinating with outside counsel where appropriate. Protect the company's intellectual property through trademark, trade secret, copyright, and open-source license management. Handle employment-related legal needs, including offer letters, employment and contractor agreements, separation agreements, and workplace policies. Manage the relationship with and budget for outside counsel, bringing work in-house where efficient and escalating specialized matters appropriately. Identify, assess, and mitigate legal risk across the business, and manage any disputes, demands, or litigation.

Regulatory Oversight & Interface: Serve as the designated Chief Compliance Officer under SEC regulations (Advisers Act).Manage all regulatory filings (e.g., ADV Parts 1 and 2, Form CRS, Form PF if applicable).Act as the primary liaison for SEC examinations, SOC 2 and other third-party audits, and inquiries. Monitor and interpret new or amended regulatory requirements and assess their impact on the firm’s operations and product offerings.

Compliance Program Development & Execution: Build, maintain, and continuously enhance the Compliance Manual, Code of Ethics, and related policies/procedures. Design and implement a risk-based compliance program, including testing and monitoring activities. Conduct regular audits of compliance systems and policies to ensure adherence and address any noncompliance with training or disciplinary action as needed. Maintain records of compliance incidents, report to management on frequency and trending topics, and make recommendations for mitigating incidents. Develop and oversee an annual compliance review and risk assessment process.

Operational Compliance: Supervise marketing/advertising review processes in line with SEC Marketing Rule standards. Ensure appropriate disclosures and recordkeeping across digital client experiences and advisor tools. Partner with product, engineering, and operations teams to embed compliance into workflows and products. Information Security & SOC 2 Compliance Own and drive the firm's SOC 2 Type 2 certification — accountable for the full lifecycle: defining audit scope and Trust Services Criteria (Security, plus Availability/Confidentiality as applicable), managing the readiness assessment, selecting and managing the third-party auditor, and delivering the report on schedule. Establish and maintain the control framework, policies, and evidence-collection cadence required to sustain Type 2 attestation across the full audit observation period (not just point-in-time).Partner with engineering, IT, and operations to implement and operate technical and administrative controls (access management, change management, vulnerability management, incident response, vendor risk).Own the GRC tooling and continuous-monitoring process (e.g., Vanta/Drata-class platforms) used to track control health and audit-readiness year-round. Serve as the primary point of contact for customer and prospect security reviews, questionnaires, and the SOC 2 report distribution process. Maintain the firm's information security policy suite and security awareness training program.

Business Advisory: Provide compliance guidance on new product launches, advisor onboarding, custodial relationships, and strategic initiatives. Support client-related escalations involving regulatory matters or complex compliance issues. Collaborate with leadership to proactively manage regulatory risks while supporting innovation and business growth.

Qualifications: J.D. or other advanced degree preferred but not required.7+ years of experience in RIA compliance, preferably with exposure to SEC-registered firms and/or wealthtech platforms. Deep knowledge of the Investment Advisers Act of 1940, SEC Marketing Rule, Custody Rule, and related regulations. Experience leading or supporting SEC examinations preferred. Experience bridging the gap between regulatory requirements and product development across digital advice platforms and portfolio management systems. Strong project management skills, with the ability to build structure in a dynamic, fast-paced startup environment. Exceptional judgment, communication skills, and business acumen. Ability to strategically interpret legal frameworks and apply a compliance lens to emerging, ambiguous regulatory landscapes, such as AI.Experience building compliance programs at an early-stage or high-growth RIA or fintech company. Demonstrated experience leading a SOC 2 Type 2 certification (or comparable security attestation/framework such as ISO 27001, NIST) from readiness through report issuance, including managing auditors and a GRC/continuous-monitoring platform. Working knowledge of the AICPA Trust Services Criteria and information security control frameworks; strong fluency partnering with engineering on technical controls.