Chief Information Security Officer

Decentralized Masters

. Own security strategy, roadmap and budget across all Catalyst Capital brands .

Posted 11/6/2026contractRemote • Florida • United States, Germany, Netherlands, United Kingdom, BrazilLeadWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive experience in leading security functions, including incident response, security strategy development, and risk management. Proficient in cloud security, identity and access management, and AI-driven security systems, with a strong focus on compliance and security policy enforcement.

Highest-signal resume keywords

CISO ExperienceIncident Response LeadershipCloud Security ExpertiseAI-Driven Security SystemsSOC 2 or ISO 27001 Preparation

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Incident ResponseSecurity Strategy DevelopmentRisk ManagementIdentity and Access ManagementCloud SecuritySecurity Policy WritingAutomation ScriptingPhishing SimulationRisk QuantificationVendor Security Assessment

Soft Skills

Executive BriefingTraining Non-Technical StaffDocumentation ThoroughnessTeam LeadershipCross-Time Zone Collaboration

Tools & Technologies

SIEMAWSEndpoint ProtectionEmail SecurityAI AgentsSecurity RunbooksSecurity Training ToolsPhishing Simulation ToolsRapid7Identity Management Tools

Certifications & Qualifications

CISSPCISMGCIHOSCP

Industry Keywords

CryptoFintechHigh-Fraud IndustrySocial EngineeringImpersonation AttacksBrand ProtectionAccount-Takeover DefenseThird-Party Risk ProgramsSecurity ComplianceAI Security Evaluation

Tech Stack

Tools & technologies

AWSCloud

About the role

Key responsibilities & impact

Own security strategy, roadmap and budget across all Catalyst Capital brands
Report security posture, top risks and trends to leadership monthly and maintain an actionable risk register
Lead incident response end to end, including detection, triage, containment, eradication, recovery and postmortems
Coordinate with legal counsel, forensics firms, insurers and regulators during incidents
Maintain incident-response runbooks and run tabletop exercises
Own group-wide identity and access security, including SSO, MFA, least-privilege roles, admin redundancy and short-lived credentials
Set the AWS security baseline
Assess third-party and vendor security, audits and attestations, and establish connection requirements
Set platform login-protection and account-takeover-defense standards with engineering teams
Own email security, staff training, phishing simulations and brand-protection takedowns
Write and enforce security policies; prepare for SOC 2 or ISO 27001 with Legal & Compliance
Own the public security and trust story, including product trust pages
Manage and develop security engineers and determine what to build in-house versus outsource
Provide security content for member scam-awareness messaging
Build and maintain a complete attack-surface inventory covering applications, cloud, repositories, SaaS tools and integrations
Design and operate AI-driven security systems for code and dependency review, configuration and access audits, and vendor documentation review
Own SIEM, Rapid7, endpoint protection, email security, identity and device-management tooling
Ensure critical systems provide usable logs; use AI to triage alerts and hunt across them
Define secure AI and vibe-coding standards, including permitted data access and review paths
Secure production AI agents and automations through scoped credentials, tool permissions, prompt-injection defenses, exposure controls, monitoring and guardrails
Review high-risk AI agents before launch

Requirements

What you’ll need

10+ years in security, including 3+ years leading a security function as CISO, Head of Security or equivalent at a company of 100+ people
Has led live-incident response, not just tabletop exercises, including briefing executives during the incident
Has built or rebuilt a security program from an early stage: strategy, policy, tooling, training and incident response
AI-native operator using AI agents daily for detections, code and configuration review, vendor documentation, policy drafting, workflows and automations
Deep, current knowledge of prompt injection, over-scoped agent permissions, credential and data exposure through AI tools, and insecure AI-generated code
Hands-on with cloud security, identity and access management, SIEM, endpoint protection and email security; AWS preferred
Writes scripts, tooling and automation, not only vendor UIs
Experience in crypto, fintech or another high-fraud industry, with deep knowledge of phishing, social engineering and impersonation attacks
Thorough with documentation, contracts and vendor security terms
Able to brief executives in plain language, train non-technical staff, and write actionable policies
Comfortable spending about half of the time hands-on while leading a small, fully remote team across many time zones
Experience preparing a company for SOC 2 or ISO 27001 preferred
Experience securing or evaluating AI agents and LLM-based tools in production preferred
Experience running third-party risk programs covering financial data aggregators or similar providers preferred
Experience running a brand protection or takedown program preferred
Experience with customer-facing security features such as account-takeover defense preferred
Experience with risk quantification (FAIR or similar) and presenting to a board preferred
Certifications such as CISSP, CISM, GCIH or OSCP preferred

Benefits

Comp & perks

Competitive compensation package
Independent Contractor opportunity
Fully remote, globally distributed team
Team offsites (Dubai, Costa Rica, etc.)
Collaborative, forward-thinking culture that values innovation and results