Chief Information Security Officer (CISO)

Catalyst Capital is a profitable, bootstrapped holding company building a diversified financial services group, including education, publishing, software, wealth and tax planning tools, investment products, and proprietary trading technology. Funded entirely from its own operating cash, Catalyst Capital has never taken outside capital.

The core cash engine is Decentralized Masters, a DeFi education business that scaled from zero to 150+ employees, 4,500+ paying members, and roughly $48.6M of FY26 revenue at ~25% earnings before tax in just four years.

Role Summary

Catalyst Capital is hiring its first Chief Information Security Officer (CISO) to oversee security across all brands in the group. This role involves setting the security strategy, building the program, and personally leading incident response when issues arise.

The position is divided into two key areas: traditional security leadership and AI-driven security. The first half focuses on incident response, identity and access management, vendor risk, phishing defense, policy, and audit readiness. The second half involves leveraging AI to map the company’s full attack surface and build automated systems for testing, monitoring, and auditing security with near-total coverage.

The role is a player-coach position, with roughly half hands-on work and the other half leading a small team of engineers. You will report directly to Group leadership, brief the leadership team monthly, and serve as the trusted advisor for risk assessment and decision-making under pressure.

Core Security Leadership (Approximately 50%)

• Develop and implement the security strategy, roadmap, and budget across all brands, including Decentralized Masters, Legacy, Inflection Club, Sentinelis, and future ventures.
• Lead end-to-end incident response, including detection, triage, containment, eradication, recovery, and postmortem analysis. Coordinate with legal counsel, forensics firms, insurers, and regulators during live incidents.
• Oversee cloud and identity security, including SSO, MFA, least-privilege roles, admin redundancy, and short-lived credentials. Set the AWS security baseline.
• Assess and mitigate third-party and vendor risk, including reviewing audits, attestations, and setting security standards for vendors before they connect to company systems.
• Establish security standards for platform and customer account security, collaborating with engineering teams to implement robust login protection and account-takeover defenses.
• Lead phishing and impersonation defense, including email security, staff training, phishing simulations, and brand protection (e.g., takedown of fake domains and impersonating accounts).
• Develop and enforce policies, compliance, and trust initiatives, preparing the company for SOC 2 or ISO 27001 compliance. Own the public security and trust narrative, including the trust page on company products.
• Manage and develop the security engineering team, deciding what to build in-house versus outsource, and growing the team where automation cannot suffice.
• Supply security content for member scam awareness messaging, collaborating with Community, Support, and Marketing teams (with Legal approval for final wording).

AI-Driven Security (Approximately 50%)

• Build and maintain a comprehensive attack-surface map of all internal apps, cloud infrastructure, code repositories, and SaaS tools/integrations (e.g., CRM, telephony, community platforms, payments, data providers).
• Design and implement AI-driven security systems achieving near 100% coverage, including automated code and dependency reviews, continuous configuration and access audits, and vendor documentation reviews. Humans set direction and make judgment calls; AI agents handle exhaustive work.
• Oversee the security stack (SIEM, Rapid7, endpoint protection, email security, identity and device management) and ensure all critical systems send usable logs. Use AI for alert triage and cross-system hunting.
• Set secure AI and vibe-coding standards, defining rules for AI tool usage, data exposure, and review paths before customer data is processed. Ensure compliance with secure AI practices.
• Secure AI agents and automations in production, addressing scoped credentials, tool permissions, prompt injection defense, data exposure, and monitoring/guardrails for agents.

Scope

This role is critical to protecting the company, its platforms, data, and brands. For members’ personal wallets and accounts outside company platforms, the focus shifts to education and scam awareness, helping members recognize and avoid scams.

Requirements

Must-Have Qualifications

• 10+ years in security, including 3+ years leading a security function as CISO, Head of Security, or equivalent at a company with 100+ employees.
• Proven experience in live incident response, not just tabletop exercises, including executive briefings during incidents.
• Experience in building or rebuilding a security program from the ground up, covering strategy, policy, tooling, training, and incident response.
• AI-native operator: Daily use of AI agents for tasks like writing detections, reviewing code/configs, reading vendor documentation, and drafting policy. Ability to demonstrate harnesses, workflows, or automations built and knowledge of where AI ends and human judgment begins.
• Deep, current knowledge of AI-specific risks, including prompt injection, over-scoped agent permissions, credential/data exposure through AI tools, and insecure AI-generated code.
• Hands-on expertise in cloud security (preferably AWS), identity and access management, SIEM, endpoint protection, and email security.
• Ability to write code for scripts, tooling, and automation, not just using vendor UIs.
• Experience in crypto, fintech, or high-fraud industries, with deep knowledge of phishing, social engineering, and impersonation attacks.
• Thoroughness in reading fine print, including documentation, contracts, and vendor security terms, with a focus on documentation to prevent oversight.
• Ability to brief executives in plain language, train non-technical staff, and write policies that people follow.
• Player-coach mindset: Comfortable spending about half of your time hands-on while leading a small, fully remote team across multiple time zones.

Nice-to-Have Qualifications

• Experience preparing a company for SOC 2 or ISO 27001 compliance.
• Experience in securing or evaluating AI agents and LLM-based tools in production.
• Experience running a third-party risk program covering financial data aggregators or similar providers.
• Experience with brand protection or takedown programs.
• Experience with customer-facing security features, such as account-takeover defense.
• Experience with risk quantification (FAIR or similar) and presenting to a board.
• Certifications such as CISSP, CISM, GCIH, or OSCP.

Benefits

• Competitive compensation package
• Independent Contractor opportunity
• Fully remote, globally distributed team
• Team offsites (e.g., Dubai, Costa Rica)
• Collaborative, forward-thinking culture that values innovation and results