Chief Information Security Officer

Own security strategy, roadmap and budget across Decentralized Masters, Legacy, Inflection Club, Sentinelis and future brands, reporting posture, top risks and trends to leadership monthly with an actionable risk register.

Own incident response end to end — detection, triage, containment, eradication, recovery and postmortem — leading during live incidents and coordinating with legal counsel, forensics firms, insurers and regulators, while keeping runbooks current and running tabletop exercises.

Own identity and access management across the group, including SSO, MFA, least-privilege roles, admin redundancy and short-lived credentials, and set the AWS security baseline.

Assess the security of every vendor and data provider the company relies on, including their audits and attestations, and set the standards vendors must meet before connecting to company systems or data.

Set standards for login protection and account-takeover defense on the company's platforms, working with the engineering teams that own each one.

Own email security, staff training and phishing simulations, and run brand protection efforts to find and take down fake domains and accounts impersonating company brands and leaders.

Write and enforce policies that people actually follow, prepare the company for SOC 2 or ISO 27001 with Legal & Compliance, and own the public security and trust story, including the trust page on company products.

Manage and develop the security engineering team, decide what to build in-house versus outsource, and grow the team only where automation can't handle the work.

Supply the security content behind scam-awareness messaging to members, working with Community, Support and Marketing, with wording approved by Legal.

Build and maintain a living inventory of everything the company runs — internal apps, cloud, code repositories, and every SaaS tool and integration such as CRM, telephony, community, payments and data providers — tracking what connects to what, who has access, and what is logged.

Design and run AI-driven systems approaching full coverage, including automated code and dependency review, continuous configuration and access audits, and vendor documentation review, with humans setting direction and making judgment calls while agents handle the exhaustive work.

Own the security stack (including SIEM, Rapid7, endpoint protection, email security, identity and device management), ensure every critical system sends usable logs, and use AI to triage alerts and hunt across them.

Set the rules for how teams build with AI, including what can ship, what data AI tools may touch, and the review process before anything touching customer data goes live.

Secure AI agents and automations as more of the company runs on them, including scoped credentials and tool permissions, prompt-injection defense, data exposure prevention, and monitoring and guardrails for agents in production, reviewing high-risk agents before launch, including the company's own security agents.

10+ years in security, including 3+ years leading a security function as CISO, Head of Security or equivalent at a company of 100+ people.

Experience leading live incident response, not just tabletop exercises, including briefing executives during an incident.

Experience building or rebuilding a security program from an early stage, covering strategy, policy, tooling, training and incident response.

Daily use of AI agents to do the work — writing detections, reviewing code and configurations, reading vendor documentation, drafting policy — with the ability to show harnesses, workflows or automations built, and judgment about where AI stops and human decision-making takes over.

Deep, current knowledge of AI-specific risks, including prompt injection, over-scoped agent permissions, credential and data exposure through AI tools, and insecure AI-generated code.

Hands-on experience with cloud security (AWS preferred), identity and access management, SIEM, endpoint protection and email security.

Ability to write code — scripts, tooling and automation — not just use vendor interfaces.

Experience in crypto, fintech or another high-fraud industry, with deep knowledge of phishing, social engineering and impersonation attacks.

Thoroughness with documentation, contracts and vendor security terms, documenting everything so nothing slips through.

Ability to brief executives in plain language, train non-technical staff, and write policy people actually follow.

Comfort as a player-coach, spending about half the time hands-on while leading a small, fully remote team across multiple time zones.