[Hiring] Chief Information Security Officer @Decentralized Masters

Role Description

Catalyst Capital is hiring its first Chief Information Security Officer to own security across every brand in the group. You will set the strategy, build the program, and personally run the response when something goes wrong.

The job is two halves:

• Core of a CISO's role: incident response, identity and access, vendor risk, phishing defense, policy and audit readiness.
• Making security AI-driven: mapping our full surface and building agentic systems that test, monitor and audit it with near-total coverage.

This is a player-coach role: about half hands-on, leading a small team of engineers.

You report to Group leadership, brief the leadership team monthly, and are the person they trust to explain risk in plain language and make the call under pressure.

What you will own

• Core security leadership (about half)
  • Security strategy and program: Own the security strategy, roadmap and budget across Decentralized Masters, Legacy, Inflection Club, Sentinelis and future brands.
  • Incident response: Own IR end to end: detection, triage, containment, eradication, recovery and the postmortem.
  • Cloud and identity security: Own identity and access across the group: SSO, MFA, least-privilege roles, admin redundancy and short-lived credentials.
  • Third-party and vendor risk: Assess the security of every vendor and data provider we depend on.
  • Platform and customer account security: Set the standards for login protection and account-takeover defense.
  • Phishing and impersonation defense: Own email security, staff training and phishing simulations.
  • Policy, compliance and trust: Write and enforce policies people actually follow.
  • Team leadership: Manage and develop our security engineers.
  • Member scam awareness: Supply the security content behind scam-awareness messaging to members.
• AI-driven security (about half)
  • Full attack-surface map: Build and maintain a living inventory of everything we run.
  • Agentic security harness: Design and run AI-driven systems that approach 100% coverage.
  • AI-driven detection and logging: Own the security stack and ensure every critical system sends usable logs.
  • Secure AI and vibe-coding standards: Set the rules for how teams build with AI.
  • AI agent security: Secure agents and automations as more of the company runs on them.

Scope

This role protects our company, our platforms, our data and our brands. For members' personal wallets and accounts outside our platforms, our role is education: helping members recognize and avoid scams.

Qualifications

• 10+ years in security, including 3+ years leading a security function as CISO, Head of Security or equivalent at a company of 100+ people.
• Has led live-incident response, not just tabletop exercises, including briefing executives during the incident.
• Has built or rebuilt a security program from an early stage: strategy, policy, tooling, training and incident response.
• AI-native operator: Uses AI agents daily to do the work.
• Deep, current knowledge of AI-specific risks.
• Hands-on with cloud security (AWS preferred), identity and access management, SIEM, endpoint protection and email security.
• Writes code: scripts, tooling and automation, not only vendor UIs.
• Experience in crypto, fintech or another high-fraud industry.
• Can read the fine print: thorough with documentation, contracts and vendor security terms.
• Briefs executives in plain language, trains non-technical staff, and writes policy people follow.
• Player-coach: comfortable spending about half your time hands-on while leading a small, fully remote team across many time zones.

Nice to have

• Has prepared a company for SOC 2 or ISO 27001.
• Has secured or evaluated AI agents and LLM-based tools in production.
• Has run a third-party risk program covering financial data aggregators or similar providers.
• Has run a brand protection or takedown program.
• Experience with customer-facing security features such as account-takeover defense.
• Experience with risk quantification (FAIR or similar) and presenting to a board.
• Certifications such as CISSP, CISM, GCIH or OSCP.

Benefits

• Competitive compensation package
• Independent Contractor opportunity
• Fully remote, globally distributed team
• Team offsites (Dubai, Costa Rica, etc.)
• Collaborative, forward-thinking culture that values innovation and results