Chief Information Security Officer

Decentralized Masters•Miami, FL

2d•Remote

About The Position

Catalyst Capital is hiring its first Chief Information Security Officer to own security across every brand in its diversified financial services group. The role sets security strategy, builds the security program, and leads incident response. It combines core security leadership—incident response, identity and access, vendor risk, phishing defense, policy, and audit readiness—with building AI-driven systems to map, test, monitor, and audit the company’s security surface. This is a player-coach position, with about half of the time spent hands-on while leading a small team of engineers. The CISO reports to Group leadership, briefs the leadership team monthly, and explains risk in plain language to support decisions under pressure. The role protects the company, its platforms, data, and brands. For members’ personal wallets and accounts outside the company’s platforms, the company’s role is educational: helping members recognize and avoid scams. Core responsibilities include owning security strategy, roadmap, budget, and risk reporting across the group; leading incident response from detection through recovery and postmortem; managing cloud and identity security; assessing third-party and vendor risk; setting platform and customer account security standards; and overseeing phishing, impersonation, policy, compliance readiness, and security communications. The CISO also manages and develops security engineers and supplies security content for member scam-awareness messaging. The AI-driven security work includes maintaining a comprehensive inventory of applications, infrastructure, repositories, SaaS tools, and integrations; building AI-driven security systems for code and dependency review, configuration and access audits, and vendor documentation review; managing security tooling, logging, alert triage, and threat hunting; setting standards for AI-assisted development; and securing AI agents and automations through scoped permissions, prompt-injection defenses, data-exposure controls, monitoring, and launch reviews.

Requirements

10 or more years of experience in security.
At least 3 years leading a security function as a CISO, Head of Security, or equivalent at a company with 100 or more people.
Experience leading live incident response, including briefing executives during an incident.
Experience building or rebuilding an early-stage security program encompassing strategy, policy, tooling, training, and incident response.
Daily practical use of AI agents for security work, with the ability to demonstrate built harnesses, workflows, or automations and distinguish where human judgment is required.
Current, deep knowledge of AI-specific risks, including prompt injection, over-scoped agent permissions, credential and data exposure through AI tools, and insecure AI-generated code.
Hands-on experience with cloud security, identity and access management, SIEM, endpoint protection, and email security; AWS is preferred.
Ability to write scripts, tooling, and automation code.
Experience in crypto, fintech, or another high-fraud industry, with deep knowledge of phishing, social engineering, and impersonation attacks.
Thoroughness in reviewing documentation, contracts, and vendor security terms, and documenting work.
Ability to brief executives in plain language, train non-technical staff, and write policies people follow.
Comfort with a player-coach role, spending about half of the time hands-on while leading a small, fully remote team across many time zones.

Nice To Haves

Experience preparing a company for SOC 2 or ISO 27001.
Experience securing or evaluating AI agents and LLM-based tools in production.
Experience running a third-party risk program covering financial data aggregators or similar providers.
Experience running a brand-protection or takedown program.
Experience with customer-facing security features such as account-takeover defense.
Experience with risk quantification such as FAIR and presenting to a board.
Certifications such as CISSP, CISM, GCIH, or OSCP.

Responsibilities

Own the security strategy, roadmap, and budget across Catalyst Capital brands, and report security posture, top risks, and trends to leadership monthly.
Maintain a risk register that leadership can use to make decisions.
Lead incident response end to end, including detection, triage, containment, eradication, recovery, and postmortems.
Coordinate live incident response with legal counsel, forensics firms, insurers, and regulators; maintain runbooks and conduct tabletop exercises.
Own group-wide identity and access security, including SSO, MFA, least-privilege roles, admin redundancy, short-lived credentials, and the AWS security baseline.
Assess third-party vendors and data providers, review their audits and attestations, and set security requirements before they connect to company systems or data.
Set login-protection and account-takeover defense standards for company platforms and work with platform engineering teams to implement them.
Own email security, staff security training, phishing simulations, and brand protection against impersonating domains and accounts.
Write and enforce practical security policies and prepare the company for SOC 2 or ISO 27001 with Legal & Compliance.
Own the public security and trust communications, including product trust pages.
Manage and develop security engineers, decide what security work to build in-house versus outsource, and expand the team where automation is insufficient.
Provide security content for member scam-awareness messaging in partnership with Community, Support, and Marketing; Legal approves the wording.
Build and maintain a living inventory of internal applications, cloud resources, code repositories, SaaS tools, and integrations, including their connections, access, and logging.
Design and operate AI-driven security systems for automated code and dependency review, continuous configuration and access audits, and vendor-documentation review, with humans retaining direction and judgment calls.
Own the security stack, including SIEM, Rapid7, endpoint protection, email security, identity management, and device management; ensure critical systems provide usable logs and use AI to triage alerts and hunt across logs.
Set secure AI and vibe-coding standards, including what may ship, what data AI tools may access, and review requirements before customer-data features go live.
Secure AI agents and automations through scoped credentials and tool permissions, prompt-injection defenses, data-exposure controls, production monitoring, and guardrails.
Review high-risk agents before launch, including the company’s security agents.