[Hiring] Head of Security Engineering @Bastion

Role Description

We are looking for a player-coach Head of Security to build and lead our security engineering function at a critical growth stage. In this role, you’ll be hands-on with our security infrastructure while establishing the strategic foundation for our security program.

• Work closely with compliance and risk teams to ensure our stablecoin platform meets the highest security standards.
• Shape security culture at a 32-person company, impacting our ability to scale safely and maintain trust.
• Inherit a strong foundation and add at least 1 security engineer to your team in Q1 2026.
• Balance hands-on security engineering with establishing and enhancing governance frameworks.
• Comfortable writing code and policies that satisfy auditors.
• Open to remote work in the United States, with an advantage to being based in NYC.

Work to Be Done

• 7 days — Rapid orientation and decision velocity:
  • Meet key stakeholders to understand business goals and risk appetite.
  • Review current security posture, tooling, processes, and identified risks.
  • Confirm incident response coverage and escalation paths.
  • Deliver an initial readout with near-term priorities.
• By day 15 - Unblock and set the operating rhythm:
  • Define Bastion’s security north star and success metrics in alignment with leadership.
  • Establish an operating cadence (standups, intake, prioritization, communication loops).
  • Kick off 1-2 high-impact risk-reduction efforts.
  • Identify key compliance and policy gaps.
• By day 30 - Ship visible progress and reduce risk:
  • Partner with Platform and App teams to implement baseline engineering guardrails.
  • Validate core detection and response workflows through a tabletop exercise.
  • Publish a simple dashboard for key security KPIs.
  • Launch lightweight enablement for engineers and security champions.
  • Begin interviewing candidates for your future team.
• By day 90 - Scale impact and prove durability:
  • Formalize security policies and governance rhythms with cross-functional partners.
  • Ship at least one security improvement that measurably improves developer velocity or reduces friction.
  • Demonstrate measurable risk reduction against agreed KPIs.
  • Define the next two quarters of the security roadmap and resourcing plan.
  • Run a resilience exercise and fold learnings into continuous improvement.

Additional Responsibilities

• Build and maintain a security program that meets regulatory standards.
• Own compliance and regulator readiness across SOC 2 and NYDFS.
• Drive product security and detection and response across the lifecycle.
• Oversee day-to-day IT and endpoint operations until the team is staffed.
• Maintain access policies and endpoint security standards.
• Manage network access controls and zero-trust posture.
• Evolve SIEM detection and alerting strategy.
• Lead execution of current security priorities, including CloudHSM readiness and annual obligations.