Chief Information Security Officer

Decentralized Masters•Miami, FL

2d•Remote

About The Position

Catalyst Capital is hiring its first Chief Information Security Officer to own security across every brand in the group. The CISO will set the strategy, build the program, and personally lead the response when incidents occur. The role is split between core security leadership and AI-driven security, and is a player-coach position that is about half hands-on while leading a small team of engineers. The CISO reports to Group leadership, briefs the leadership team monthly, and explains risks in plain language to support decisions under pressure. The role protects the company, its platforms, data and brands. For members' personal wallets and accounts outside the company's platforms, the company's role is education to help members recognize and avoid scams. Core responsibilities include security strategy and program ownership; incident response; cloud and identity security; third-party and vendor risk; platform and customer account security; phishing and impersonation defense; policy, compliance and trust; team leadership; and providing security content for member scam-awareness messaging. The CISO will prepare the company for SOC 2 or ISO 27001 with Legal & Compliance and own the public security and trust story. AI-driven security responsibilities include building and maintaining a full attack-surface inventory; designing AI-driven systems for code, dependency, configuration, access and vendor-documentation review; owning the security stack and usable logging; using AI to triage alerts and hunt across logs; setting standards for AI-assisted development; and securing production agents and automations through scoped permissions, prompt-injection defenses, data-exposure controls, monitoring and guardrails.

Requirements

10+ years of experience in security, including 3+ years leading a security function as a CISO, Head of Security or equivalent at a company of 100+ people.
Experience leading live incident response, including executive briefings during incidents, not only tabletop exercises.
Experience building or rebuilding an early-stage security program, including strategy, policy, tooling, training and incident response.
Daily practical use of AI agents to perform security work, with the ability to demonstrate built harnesses, workflows or automations and distinguish where human judgment is required.
Deep, current knowledge of AI-specific risks, including prompt injection, over-scoped agent permissions, credential and data exposure through AI tools, and insecure AI-generated code.
Hands-on experience with cloud security (AWS preferred), identity and access management, SIEM, endpoint protection and email security.
Ability to write code, including scripts, tooling and automation, rather than relying only on vendor interfaces.
Experience in crypto, fintech or another high-fraud industry, and deep knowledge of phishing, social engineering and impersonation attacks.
Thoroughness with documentation, contracts and vendor security terms, and a practice of documenting work so details are not missed.
Ability to brief executives in plain language, train non-technical staff and write policies people follow.
Comfort with a player-coach role, spending about half of the time hands-on while leading a small, fully remote team across many time zones.

Nice To Haves

Experience preparing a company for SOC 2 or ISO 27001.
Experience securing or evaluating AI agents and LLM-based tools in production.
Experience running a third-party risk program covering financial data aggregators or similar providers.
Experience running a brand-protection or takedown program.
Experience with customer-facing security features such as account-takeover defense.
Experience with risk quantification (FAIR or similar) and presenting to a board.
Certifications such as CISSP, CISM, GCIH or OSCP.

Responsibilities

Own the security strategy, roadmap and budget across Decentralized Masters, Legacy, Inflection Club, Sentinelis and future brands.
Report security posture, top risks and trends to leadership monthly, maintaining an actionable risk register.
Own incident response end to end, including detection, triage, containment, eradication, recovery and postmortems; lead live incidents and coordinate with legal counsel, forensics firms, insurers and regulators.
Maintain incident-response runbooks and conduct tabletop exercises.
Own group identity and access security, including SSO, MFA, least-privilege roles, admin redundancy and short-lived credentials, and establish the AWS security baseline.
Assess third-party and vendor security, including audits and attestations, and establish requirements vendors must meet before connecting to company systems or data.
Set standards for platform login protection and account-takeover defense, working with the engineering teams that own each platform to implement them.
Own email security, staff training and phishing simulations; identify and take down fake domains and accounts impersonating company brands and leaders.
Write and enforce practical security policies, prepare the company for SOC 2 or ISO 27001 with Legal & Compliance, and own the public security and trust story, including product trust pages.
Manage and develop security engineers, decide what to build in-house versus outsource, and expand the team where automation cannot do the work.
Provide security content for member scam-awareness messaging in collaboration with Community, Support and Marketing; Legal approves the wording.
Build and maintain a living inventory of internal apps, cloud, code repositories, SaaS tools and integrations, including their connections, access and logging.
Design and operate AI-driven security systems for automated code and dependency review, continuous configuration and access audits, and vendor-documentation review, with humans making direction-setting and judgment calls.
Own the security stack, including SIEM (Rapid7), endpoint protection, email security, and identity and device management; ensure critical systems provide usable logs and use AI to triage alerts and hunt across logs.
Set standards for AI-assisted development, including what may ship, what data AI tools may access, and the review path for work involving customer data.
Secure agents and automations through scoped credentials and tool permissions, prompt-injection defenses, data-exposure controls, and production monitoring and guardrails.
Review high-risk agents before launch, including the company's own security agents.