Head of Security at Morpho

As Head of Security at Morpho, you will define and drive Morpho’s security strategy across the entire organization—corporate IT, cloud and infrastructure, application, supply chain, identity, incident response, threat intelligence, and counterparty security. This is a hands-on leadership role where you will personally execute critical security work while building and scaling the security team.

You will also serve as Morpho’s credible security voice, both internally to leadership and externally to integrators, institutions, and ecosystem partners who depend on the platform’s security. You will partner closely with Engineering on infrastructure and deployment integrity, and with the Integration team, which works with various partners across the Morpho ecosystem.

Key Responsibilities:

• Own and continuously evolve Morpho’s security strategy and roadmap across cloud/infrastructure, application, supply-chain, identity, and operational security.
• Build and lead the security function, including hiring, growing, and developing the team across security operations and application security.
• Oversee the IT function to ensure alignment with security goals.
• Stay hands-on with threat modeling, architecture review, control implementation, and incident command while the team scales.
• Set the governance architecture, creating a coherent security framework that ties tooling and controls together.
• Own incident response end-to-end, including runbooks, incident command, severity and escalation structures, and market communication during events.
• Build and run a counterparty security program for curators and partners, including identity verification, screening, operational diligence, and bidirectional incident-coordination channels.
• Lead Morpho’s certification strategy (e.g., SOC 2, ISO 27001), ensuring compliance with both the letter and spirit of standards.
• Represent Morpho’s security posture externally to fintechs, financial institutions, and the broader ecosystem, and internally to executives.
• Partner cross-functionally with Engineering, Protocol, and Integrations to drive security outcomes.

What Success Looks Like:

First 30 Days:

• Build a clear, independent picture of Morpho’s posture, architecture, threat model, and in-flight work, and pressure-test the existing strategy against it.
• Meet the team and establish working relationships with key stakeholders.
• Understand the path-to-funds attack surface in depth and identify the highest-severity risks and quick wins.
• Assess the current state of incident-response readiness.

First 60 Days:

• Publish a clearly prioritized security roadmap with sequencing, owners, and rationale for deferred items, aligning leadership.
• Define the team build-out plan and open the first hire.
• Personally drive the top-severity gaps, including identity and authentication enforcement, deployment guardrails, and incident-response runbooks.
• Set the governance framework and initiate the certification path.

First 90 Days:

• Demonstrate progress closing the highest-priority gaps, with key controls enforced rather than optional.
• Establish a documented incident-response capability validated by at least one tabletop exercise.
• Hiring underway, with a clear operating rhythm established with Engineering, Protocol, and Integrations.
• Morpho’s external security posture takes shape, including trust surface, counterparty security program, and ecosystem engagement, and you are recognized internally and externally as Morpho’s credible security voice.

Must-Have Experience & Skills:

• 10+ years in security, several of them building or leading a security function, ideally at a crypto/web3, fintech, or financial-services company where security is core to the business.
• Strong grasp of the crypto/web3 threat model.
• Proven experience building and growing a security team from a small base, recruiting across security operations and application/infrastructure security.
• Deep, hands-on technical expertise across cloud, infrastructure, CI/CD, supply-chain, identity, and application security—you do the work, not just direct it.
• Owned incident response end-to-end, including incident command and external communication.
• Sharp prioritization and ability to galvanize action through hard and soft influence, including driving outcomes through teams you don’t own.
• Exceptional, organized, responsive communication—credible to executives and external audiences.
• Humble.

Nice to Have:

• An established network and public profile in the security or crypto-security community, and comfort representing security work publicly (talks, writing, framework contribution).
• Offensive security depth or experience standing up red/blue capabilities.
• Familiarity with institutional and regulatory expectations and threat-sharing networks (e.g., Crypto ISAC, TIBER-style frameworks).
• Experience taking an organization through certifications (e.g., SOC 2, ISO 27001).