Chief Information Security Officer

This is a fully remote position, open to applicants in United States, +5 more locations.

📋 Description

• Take charge of the security strategy, roadmap, and budget for all Catalyst Capital brands.

• Provide monthly reports on security posture, key risks, and trends to leadership, while maintaining an actionable risk register.

• Oversee incident response from start to finish, which includes detection, triage, containment, eradication, recovery, and post-incident analysis.

• Collaborate with legal counsel, forensics firms, insurers, and regulators during incidents.

• Maintain incident-response runbooks and conduct tabletop exercises.

• Manage organization-wide identity and access security, encompassing SSO, MFA, least-privilege roles, administrative redundancy, and short-lived credentials.

• Establish the security baseline for AWS.

• Evaluate third-party and vendor security, including audits and attestations, and define connection requirements.

• Set standards for platform login protection and account takeover defense in conjunction with engineering teams.

• Oversee email security, staff training, phishing simulations, and brand protection takedowns.

• Draft and enforce security policies; prepare for SOC 2 or ISO 27001 in collaboration with Legal & Compliance.

• Manage the public security and trust narrative, including product trust pages.

• Lead and develop security engineers while deciding what aspects to build internally versus outsourcing.

• Create security content for member scam awareness communications.

• Develop and maintain a comprehensive attack-surface inventory that includes applications, cloud services, repositories, SaaS tools, and integrations.

• Design and implement AI-driven security systems for code and dependency reviews, configuration and access audits, and vendor documentation assessments.

• Manage SIEM, Rapid7, endpoint protection, email security, and identity and device management tools.

• Ensure critical systems generate usable logs; leverage AI for alert triage and hunting across logs.

• Define standards for secure AI and vibe coding, including permitted data access and review processes.

• Ensure the security of production AI agents and automations through scoped credentials, tool permissions, prompt-injection defenses, exposure controls, monitoring, and guardrails.

• Review high-risk AI agents prior to their launch.

⛳️ Requirements

• 10+ years of experience in security, including at least 3 years leading a security function as CISO, Head of Security, or similar role in a company with 100+ employees.

• Experience in live incident response, not just tabletop exercises, including briefing executives during incidents.

• Proven experience in building or rebuilding a security program from the ground up: strategy, policy, tooling, training, and incident response.

• An AI-native operator who utilizes AI agents daily for detections, code and configuration reviews, vendor documentation, policy drafting, workflows, and automations.

• In-depth, current knowledge of prompt injection, over-scoped agent permissions, credential and data exposures through AI tools, and insecure AI-generated code.

• Practical experience with cloud security, identity and access management, SIEM, endpoint protection, and email security; AWS experience preferred.

• Proficient in writing scripts, tooling, and automation beyond vendor UIs.

• Background in crypto, fintech, or another high-fraud sector, with extensive knowledge of phishing, social engineering, and impersonation attacks.

• Detail-oriented when it comes to documentation, contracts, and vendor security terms.

• Capable of briefing executives in layman’s terms, training non-technical staff, and drafting actionable policies.

• Comfortable dedicating approximately half of the time to hands-on work while leading a small, fully remote team across various time zones.

• Experience in preparing a company for SOC 2 or ISO 27001 is preferred.

• Familiarity with securing or evaluating AI agents and LLM-based tools in production is a plus.

• Experience managing third-party risk programs that involve financial data aggregators or similar providers is preferred.

• Background in running a brand protection or takedown program is preferred.

• Experience with customer-facing security features such as account takeover defense is preferred.

• Knowledge of risk quantification (FAIR or similar) and presenting findings to a board is preferred.

• Relevant certifications such as CISSP, CISM, GCIH, or OSCP are preferred.

🏝️ Benefits

• Competitive compensation package.

• Opportunity for independent contracting.

• Fully remote position with a globally distributed team.

• Team offsites in locations like Dubai, Costa Rica, etc.

• Collaborative, innovative culture that values results.