DM
Chief Information Security Officer
Contract type
Ongoing
Work mode
Remote · Berlin, Germany
Experience
Lead / principal · 10+ years
Job description
First Chief Information Security Officer at Catalyst Capital, owning security strategy and incident response across all group brands while building AI-driven, agentic security systems. A player-coach role, roughly half hands-on, leading a small fully remote team of security engineers.
At a glance
- Work mode
- Remote · Berlin, Germany
What you'll do
- Own the security strategy, roadmap and budget across Decentralized Masters, Legacy, Inflection Club, Sentinelis and future brands
- Report posture, top risks and trends to leadership every month, with a risk register leadership can act on
- Own incident response end to end: detection, triage, containment, eradication, recovery and the postmortem
- Lead the room during a live incident and coordinate with legal counsel, forensics firms, insurers and regulators
- Keep runbooks current and run tabletop exercises
- Own identity and access across the group: SSO, MFA, least-privilege roles, admin redundancy and short-lived credentials
- Set the AWS security baseline
- Assess the security of every vendor and data provider, including their audits and attestations, and set the bar a vendor must clear
- Own email security, staff training and phishing simulations
- Run brand protection: find and take down fake domains and accounts impersonating our brands and leaders
- Write and enforce policies people actually follow
- Prepare the company for SOC 2 or ISO 27001 with Legal & Compliance
- Own the public security and trust story, including the trust page on our products
- Manage and develop our security engineers, decide what we build in-house versus outsource, and grow the team only where automation cannot do the job
- Supply the security content behind scam-awareness messaging to members, working with Community, Support and Marketing
- Build and maintain a living inventory of everything we run: internal apps, cloud, code repos, and every SaaS tool and integration
- Design and run AI-driven systems that approach 100% coverage: automated code and dependency review, continuous configuration and access audits, and vendor documentation review
- Own the security stack (SIEM, Rapid7; endpoint protection; email security; identity and device management), make sure every critical system sends usable logs, and use AI to triage alerts and hunt across them
- Set the rules for how teams build with AI: what can ship, what data AI tools may touch, and the review path before anything with customer data goes live
- Secure AI agents and automations: scoped credentials and tool permissions, prompt-injection defense, data exposure, and monitoring and guardrails for agents in production
- Review high-risk agents before launch, including our own security agents
What we're looking for
- 10+ years in security, including 3+ years leading a security function as CISO, Head of Security or equivalent at a company of 100+ people
- Has led live-incident response, not just tabletop exercises, including briefing executives during the incident
- Has built or rebuilt a security program from an early stage: strategy, policy, tooling, training and incident response
- AI-native operator: uses AI agents daily to do the work (writing detections, reviewing code and configs, reading vendor documentation, drafting policy), can show harnesses, workflows or automations built, and knows where AI stops and human judgment has to take over
- Deep, current knowledge of AI-specific risks: prompt injection, over-scoped agent permissions, credential and data exposure through AI tools, and insecure AI-generated code
- Hands-on with cloud security (AWS preferred), identity and access management, SIEM, endpoint protection and email security
- Writes code: scripts, tooling and automation, not only vendor UIs
- Experience in crypto, fintech or another high-fraud industry, and deep knowledge of phishing, social engineering and impersonation attacks
- Thorough with documentation, contracts and vendor security terms, and documents everything so nothing slips through
- Briefs executives in plain language, trains non-technical staff, and writes policy people follow
- Player-coach: comfortable spending about half your time hands-on while leading a small, fully remote team across many time zones
Nice to have
- Has prepared a company for SOC 2 or ISO 27001
- Has secured or evaluated AI agents and LLM-based tools in production
- Has run a third-party risk program covering financial data aggregators or similar providers
- Has run a brand protection or takedown program
- Experience with customer-facing security features such as account-takeover defense
- Experience with risk quantification (FAIR or similar) and presenting to a board
- Certifications such as CISSP, CISM, GCIH or OSCP
Benefits
- Competitive
Apply
About Catalyst Capital
A profitable, bootstrapped holding company building a diversified financial services group: education, publishing, software, wealth and tax planning tools, investment products and proprietary trading technology. Funded entirely from its own operating cash; has never taken outside capital.
Key facts
- Financial services
- The cash engine is Decentralized Masters, a DeFi education business that went from zero to 150+ people, 4,500+ paying members and roughly $48.6M of FY26 revenue at ~25% earnings before tax in four yea
- Brands include Decentralized Masters, Legacy, Inflection Club and Sentinelis
- Funded entirely from its own operating cash; has never taken outside capital