Security Manager

Catalyst Capital is a profitable, bootstrapped holding company building a diversified financial services group, including education, publishing, software, wealth & tax planning tools, investment products, and proprietary trading technology.

The Role

Catalyst Capital is hiring a Security Manager to oversee security across all brands. This role involves running the security program, leading incident response, and building a small security team as the company grows. The position is a hands-on leadership role where you set the direction while also performing technical work.

You will report directly to the Head of Technology and provide monthly briefings to the leadership team. In case of incidents, you will be the trusted point of contact to lead response efforts and communicate findings clearly.

What You Will Own

• Security program: Develop and execute the security strategy and roadmap for brands like Decentralized Masters, Legacy, Inflection Club, and future ventures. Provide monthly reports on security posture and risk to leadership.
• Incident response: Lead end-to-end incident response, including maintaining runbooks, conducting tabletop exercises, and writing actionable postmortems for leadership.
• Team leadership: Manage and develop the Security Engineer, and grow the security team as the company scales.
• Policy and audit readiness: Create and enforce security policies (access control, acceptable use, data handling, vendor review, and incident response) that are practical and followed. Prepare the company for audits like SOC 2, collaborating with Legal & Compliance.
• Phishing and impersonation defense: Oversee email security, staff training, and phishing simulations. Implement brand protection by identifying and shutting down fake domains and impersonating accounts on social media.
• Platform and account security: Define security standards for customer accounts, including login protection and account-takeover defense. Collaborate with engineering teams to integrate these standards into platforms.
• AI and automation security: Establish rules for handling credentials, data, and tool permissions for AI agents and automations. Review high-risk automations before deployment.
• Security tooling and vendors: Manage the security stack (SIEM, endpoint protection, email security, identity and device management) and the associated vendors. Set device and access standards for IT operations.
• Member scam awareness: Develop security content for scam-awareness messaging to members, in collaboration with Community, Support, and Marketing. Legal approves the final wording.

Scope

This role is responsible for protecting the company, its platforms, and its brands. For members' personal wallets and accounts outside the platforms, the focus shifts to education—helping members recognize and avoid scams.

Requirements

What You Will Bring

• 5+ years in security, including at least 2 years leading a security function or serving as senior security personnel at a company of 100+ people.
• Experience leading live-incident response, not just tabletop exercises.
• Experience in building or rebuilding a security program from an early stage, covering policy, tooling, training, and incident response.
• Background in crypto, fintech, or another high-fraud industry.
• Deep, current knowledge of phishing, social engineering, and impersonation attacks, along with defense strategies.
• Hands-on experience with SIEM, endpoint protection, email security, and identity and device management platforms.
• Ability to write scripts and automation rather than relying solely on vendor UIs.
• Capacity to write clear security policies that people actually follow.
• Experience briefing executives in plain language and training non-technical staff.
• Comfort leading a fully remote team across multiple time zones.

Nice to Have

• Experience preparing a company for SOC 2 or ISO 27001.
• Experience running a brand protection or takedown program.
• Background in securing or evaluating AI agents and LLM-based tools.
• Experience with customer-facing security features like account-takeover defense.
• Certifications such as CISSP, CISM, GCIH, OSTH, or OSCP.

How We Hire

Our hiring process culminates with every finalist presenting a 90-day security plan to the Head of Technology, detailing initial priorities, fixes, and progress metrics.

Benefits

What We Offer

• Competitive compensation package
• Independent Contractor opportunity
• Fully remote, globally distributed team
• Team offsites
• Collaborative, forward-thinking culture that values innovation and results