[Hiring] Head of Security @Hashgraph

Role Description

We are hiring a Head of Security to help advance our mission by building the security function for a digital asset trading platform that operates as its own business unit, alongside an established security organization that provides shared services and standards. This role exists to ensure that user funds and platform infrastructure are protected, and that the governance around them earns the trust of regulators and institutional partners.

In this role, you will:

• Set the security strategy and own the policy framework and risk management program for the business unit.
• Establish governance, including escalation paths, risk registers, risk acceptance and exception processes, and a metrics-driven reporting cadence for executives and external stakeholders.
• Decide which certifications, attestations, and regulatory frameworks the business needs, managing third-party and vendor risk.
• Oversee custody, wallet infrastructure, key management, and hot, warm, and cold wallet operations.
• Govern smart contract security through audit requirements, bug bounty programs, and secure release gates.
• Own security monitoring and incident response, including crisis playbooks for exploits, key compromise, and market-impacting events.
• Lead a small security function that combines direct execution with tooling, partners, and shared services.
• Manage the security budget, tooling strategy, and vendor relationships.
• Partner with engineering, product, legal, and finance to embed security into how the company builds and operates.

What success looks like in 6-12 months:

• A right-sized governance framework is operating, with a risk register, an exception process, defined ownership, metrics reported to the business unit’s leadership, and clear escalation.
• The certifications, attestations, and regulatory frameworks the business needs have been determined, and the path to them has been delivered with clean outcomes.
• Incident playbooks for key compromise, exploits, and market-impacting events are written, and the team has worked through at least one tabletop exercise.
• A staffing plan for the function is in place, setting out what to hire and what to draw from shared services, sequenced to risk and business growth.

Qualifications

• 10+ years in information security, including 5+ years in senior security leadership.
• Direct security leadership experience at a centralized exchange (CEX), decentralized exchange (DEX), or comparable digital asset trading or custody platform.
• A track record designing and running security governance programs covering policy, risk, audit, and executive reporting.
• Strong understanding of crypto-native threats, including private key compromise, smart contract exploits, oracle and bridge attacks, front-end and supply chain compromise, insider risk, and social engineering.
• Working knowledge of key management and custody models (HSM, MPC, multisig) and blockchain protocol fundamentals.

Requirements

• Judgment to decide which frameworks and certifications are warranted for a given stage and market.
• Practical judgment about what a lean function should build itself and what it should draw from shared services, tooling, and partners.
• Technical judgment balanced with program-level governance, in a senior, hands-on role with direct visibility to executive leadership.
• Comfort working in a lean team and a matrixed environment.
• The ability to communicate clearly with engineers, executives, regulators, and auditors.

Preferred Skills and Experience

• Regulatory engagement across multiple jurisdictions (US, EU, UAE, APAC).
• Background in smart contract security, DeFi protocol risk, or on-chain monitoring and forensics.
• Experience standing up a security function inside a newer or fast-scaling business unit.
• Familiarity with DevSecOps and application security posture management.
• Relevant certifications such as CISSP, CISM, CISA, or CCSP.
• Contributions to industry standards bodies, ISACs, or open security communities.