Chief Information Security Officer — Autheo | Blockchain, Crypto & Web3 Security

Launch Legends•Cheyenne, WY

1d•Remote

About The Position

Autheo is seeking a Chief Information Security Officer to own security for its Layer-0 Operating System and integrated Layer-1 blockchain. The role covers keys and signing, the Cosmos-EVM chain, validators and nodes, the Hyperlane-based Autheo Bridge, smart contracts, TheoID, and the wider security program. The company has third-party audits from Halborn, CertiK, and Adevar Labs; the CISO will manage audit findings, remediation ownership, and retesting while leading security for production Web3 systems. This is a part-time equity and token-based cofounder opportunity with no cash salary and a commitment of at least 20 hours per week. The CISO will own the security program, make security decisions, and work directly with protocol, SRE, and contract engineering teams. The role reports to the Managing Directors and includes leading and growing the security team. The position also covers security program development, responsible disclosure and bug bounty, secure development practices, cloud and DevOps security, risk reporting, incident response, and collaboration with risk, governance, legal, privacy, and AI security leadership. During the first 90 days, expected deliverables include a key and custody inventory, a map of the security surface and risks, an audit-findings backlog, and an incident-response runbook with a tabletop exercise and initial disclosure or bug-bounty scope.

Requirements

Hands-on Web3 or blockchain security experience securing a production protocol, L1 or L2, bridge, DeFi application, wallet, or custody platform; applicants should identify the system and their contribution.
Experience with key management, HSM, MPC or threshold signing, custody, and wallet or transaction-signing security.
Experience securing blockchain infrastructure, such as validator or node operations, consensus-adjacent systems, bridges, or cross-chain messaging.
Smart-contract security experience, including scoping audits with Web3 auditors and driving findings through remediation and retesting.
Leadership of on-chain incident response involving an exploit, key compromise, bridge or validator incident, or serious near-miss, with the timeline, decisions, and resulting changes described.
At least 10 years of information-security experience, including at least 3 years as a CISO, VP of Security, Head of Security, or equivalent leadership role with responsibility for priorities, incidents, and people.
Ability to work directly with protocol engineers, SRE, and contract developers.

Nice To Haves

Post-quantum migration work involving ML-KEM, ML-DSA, or SLH-DSA, or applied cryptography experience such as threshold signatures, zero-knowledge proofs, or formal verification.
Experience with Cosmos SDK, CometBFT, IBC, EVM, or Hyperlane.
Experience running a bug-bounty or disclosure program and a public artifact such as an audit response, post-mortem, threat model, CVE, or talk.
Production AI endpoint security experience.
Experience establishing or operating SOC 2 or ISO 27001; CISSP, CISM, or CIPP credentials.
Prior founder or equity-compensated leadership experience.

Responsibilities

Own key management for validator, bridge, deployer, admin, and service keys, including generation, storage, rotation, recovery, and revocation.
Set custody and signing architecture, including HSMs, MPC or threshold signing, multisig, hardware-wallet policy, quorum, and approval rules.
Secure wallet and transaction-signing flows for users and developers, including key derivation, signing prompts, and wallet integrations.
Drive TheoID’s post-quantum roadmap using NIST ML-KEM, ML-DSA, and SLH-DSA, with a crypto-agile migration path.
Harden validators, nodes, RPC, and consensus-adjacent operations in collaboration with protocol engineering and Site Reliability.
Own security for the Autheo Bridge, including Hyperlane-based warp routes, node-license and wrapped-asset contracts, interchain security module and relayer configuration, and bridge frontend.
Review smart contracts before release and after changes, including upgradeable patterns, access controls, admin keys, and pause and upgrade powers.
Lead on-chain incident response, including monitoring, alerting, runbooks, exploit containment, forensics, coordination with validators and partners, and public post-mortems.
Manage third-party audits, including scope, findings triage, remediation owners, and retesting.
Establish and operate a responsible-disclosure and bug-bounty program for deployed systems, with severity and reward rules.
Build internal security review practices, including threat models, secure development lifecycle for Rust, Go, and Solidity, dependency and supply-chain controls, and pre-deployment checklists.
Work with the VP of AI Security on THEO AI inference and agent endpoints and the Autheo Marketplace’s compute and storage surfaces.
Cover cloud, DevOps, CI/CD, and access management for the team shipping the chain.
Partner with risk, governance and controls, and Legal / Privacy counsel on SOC 2 and related frameworks, including ISO 27001, GDPR, and CCPA.
Lead and grow the security team and communicate risk and trade-offs to the Managing Directors.
Within the first 90 days, inventory important keys and custody practices; document the security surface, deployments, audits, and risks; create an audit-findings backlog; and establish an incident-response runbook, conduct a tabletop, and define initial disclosure or bug-bounty scope.