Security Manager

This is a fully remote position, open to applicants in United States, +6 more locations.

📋 Description

• Take ownership of the security strategy and roadmap for Decentralized Masters, Legacy, Inflection Club, and upcoming brands.

• Provide monthly reports on the security posture and associated risks to leadership.

• Lead incident response activities from start to finish and manage the team during live incidents.

• Maintain up-to-date runbooks, conduct tabletop exercises, and create actionable postmortems.

• Oversee and nurture the Security Engineer, while building the security team as the organization expands.

• Develop and enforce security policies related to access control, acceptable use, data handling, vendor reviews, and incident response.

• Prepare the organization for audits like SOC 2, collaborating with Legal & Compliance departments.

• Manage email security initiatives, staff training, and phishing simulation programs.

• Conduct brand protection efforts by identifying and taking down fraudulent domains and social media accounts impersonating the company.

• Establish security standards for customer accounts, including login protection and defenses against account takeover.

• Collaborate with engineering teams to implement security measures for customer-facing platforms.

• Define protocols for AI agents and automations regarding credentials, data, and tool permissions.

• Review high-risk AI agents and automations prior to their launch.

• Manage the security stack and vendor relationships, including SIEM, endpoint protection, email security, identity management, and device management.

• Establish device and access standards for IT operations.

• Provide scam awareness content to members in partnership with Community, Support, and Marketing teams.

• Safeguard the company, platforms, and brands while educating members about scams impacting personal wallets and external accounts.

• Report directly to the Head of Technology and deliver monthly updates to the leadership team.

• Present a 90-day security strategy to the Head of Technology as a finalist.

⛳️ Requirements

• Minimum of 5 years of experience in security, with at least 2 years in a leadership role or as senior security personnel in a company of over 100 employees.

• Proven experience leading live incident responses, beyond just tabletop exercises.

• Experience in building or revamping a security program from inception, including policy creation, tooling, training, and incident response.

• Background in crypto, fintech, or another industry with a high incidence of fraud.

• Extensive and up-to-date knowledge of phishing, social engineering, and impersonation attacks along with defense strategies.

• Practical experience with SIEM, endpoint protection, email security, and identity and device management platforms.

• Ability to write scripts and automate processes without solely relying on vendor user interfaces.

• Competence in drafting clear security policies and ensuring compliance among staff.

• Capable of briefing executives in straightforward language and providing training to non-technical personnel.

• Comfortable leading a fully remote team across various time zones.

• Nice to have: Experience preparing a company for SOC 2 or ISO 27001 compliance.

• Nice to have: Experience managing a brand protection or takedown program.

• Nice to have: Familiarity with securing or assessing AI agents and LLM-based tools.

• Nice to have: Experience with customer-facing security features, such as account takeover defenses.

• Nice to have: Relevant certifications such as CISSP, CISM, GCIH, OSTH, or OSCP.

🏝️ Benefits

• Competitive compensation package.

• Opportunity as an Independent Contractor.

• Fully remote position within a globally distributed team.

• Team offsite events.

• A collaborative, innovative culture that values results.