Security Manager

Decentralized Masters•Miami, FL

6d•Remote

About The Position

Catalyst Capital is hiring a Security Manager to own security across our brands. This role involves running the security program, leading incident response, and building a small security team as the company grows. It is a hands-on leadership position where the individual sets the direction and performs technical work. The Security Manager reports to the Head of Technology and briefs leadership monthly. Key responsibilities include owning the security strategy and roadmap, leading incident response end-to-end, managing and developing the security team, writing and enforcing security policies, defending against phishing and impersonation, setting platform and account security standards, managing AI and automation security, overseeing security tooling and vendors, and contributing to member scam awareness efforts. This role protects the company, its platforms, and its brands, with an educational focus on helping members avoid scams outside the company's platforms.

Requirements

5+ years in security, including at least 2 years leading a security function or serving as senior security personnel at a company of 100+ people.
Has led live-incident response, not just tabletop exercises.
Has built or rebuilt a security program from an early stage: policy, tooling, training, and incident response.
Experience in crypto, fintech, or another high-fraud industry.
Deep, current knowledge of phishing, social engineering, and impersonation attacks and how to defend against them.
Hands-on experience with SIEM, endpoint protection, email security, and identity and device management platforms.
Can write scripts and automation rather than relying only on vendor UIs.
Writes clear security policy and gets people to follow it.
Briefs executives in plain language and trains non-technical staff.
Comfortable leading in a fully remote team spread across many time zones.

Nice To Haves

Has prepared a company for SOC 2 or ISO 27001.
Has run a brand protection or takedown program.
Experience securing or evaluating AI agents and LLM-based tools.
Experience with customer-facing security features such as account-takeover defense.
Certifications such as CISSP, CISM, GCIH, OSTH, or OSCP.

Responsibilities

Own the security strategy and roadmap across Decentralized Masters, Legacy, Inflection Club, and future brands.
Report on security posture and risk to leadership every month.
Own incident response end to end and lead the room during live incidents.
Keep runbooks current, run tabletop exercises, and write postmortems leadership can act on.
Manage and develop our Security Engineer, and build the security team as the company scales.
Write and enforce security policies that people actually follow: access control, acceptable use, data handling, vendor review, and incident response.
Prepare the company for audits such as SOC 2, working with Legal & Compliance.
Own email security, staff training, and phishing simulations.
Run brand protection: find and take down fake domains and accounts impersonating our brands on social media platforms.
Set the security standards for customer accounts on our platforms, including login protection and account-takeover defense, and work with the engineering teams that own each platform to build them in.
Set the rules for how AI agents and automations handle credentials, data, and tool permissions, and review high-risk ones before they go live.
Own the security stack (SIEM, endpoint protection, email security, identity and device management) and the vendors behind it.
Set the device and access standards that IT runs day to day.
Supply the security content behind our scam-awareness messaging to members, working with Community, Support, and Marketing.