Chief Information Security Officer

Who We Are

Catalyst Capital is a profitable, bootstrapped holding company building a diversified financial services group: education, publishing, software, wealth and tax planning tools, investment products and proprietary trading technology.

Funded entirely from its own operating cash.

We have never taken outside capital.

The cash engine is Decentralized Masters, a De Fi education business that went from zero to 150+ people, 4,500+ paying members and roughly $48.6M of FY26 revenue at ~25% earnings before tax in four years.

That engine funds everything else on this page.

Role summary

Catalyst Capital is hiring its first Chief Information Security Officer to own security across every brand in the group.

You will set the strategy, build the program, and personally run the response when something goes wrong.

The job is two halves.

Half is the core of a CISO's role: incident response, identity and access, vendor risk, phishing defense, policy and audit readiness, and the judgment calls only a person can own.

The other half is making security AI-driven: mapping our full surface and building agentic systems that test, monitor and audit it with near-total coverage, so security keeps pace as more of the company runs on AI.

This is a player-coach role: about half hands-on, leading a small team of engineers.

You report to Group leadership, brief the leadership team monthly, and are the person they trust to explain risk in plain language and make the call under pressure.

• What you will own
• Core security leadership (about half)
• Security strategy and program.

Own the security strategy, roadmap and budget across Decentralized Masters, Legacy, Inflection Club, Sentinelis and future brands.

Report posture, top risks and trends to leadership every month, with a risk register leadership can act on.

• Incident response.

Own IR end to end: detection, triage, containment, eradication, recovery and the postmortem.

Lead the room during a live incident and coordinate with legal counsel, forensics firms, insurers and regulators.

Keep runbooks current and run tabletop exercises.

• Cloud and identity security.

Own identity and access across the group: SSO, MFA, least-privilege roles, admin redundancy and short-lived credentials.

Set the AWS security baseline.

• Third-party and vendor risk.

Assess the security of every vendor and data provider we depend on, including their audits and attestations, and set the bar a vendor must clear before connecting to our systems or data.

• Platform and customer account security.

Set the standards for login protection and account-takeover defense on our platforms, and work with the engineering teams that own each platform to build them in.

• Phishing and impersonation defense.

Own email security, staff training and phishing simulations.

Run brand protection: find and take down fake domains and accounts impersonating our brands and leaders.

• Policy, compliance and trust.

Write and enforce policies people actually follow.

Prepare the company for SOC 2 or ISO 27001 with Legal & Compliance.

Own the public security and trust story, including the trust page on our products.

• Team leadership. Manage and develop our security engineers, decide what we build in-house versus outsource, and grow the team only where automation cannot do the job.
• Member scam awareness. Supply the security content behind scam-awareness messaging to members, working with Community, Support and Marketing. Legal approves the wording.
• AI-driven security (about half)
• Full attack-surface map.

Build and maintain a living inventory of everything we run: internal apps, cloud, code repos, and every Saa S tool and integration (CRM, telephony, community, payments, data providers).

Know what connects to what, who has access, and what is logged.

• Agentic security harness.

Design and run AI-driven systems that approach 100% coverage: automated code and dependency review, continuous configuration and access audits, and vendor documentation review.

Humans set direction and make the judgment calls; agents do the exhaustive work.

• AI-driven detection and logging.

Own the security stack (SIEM, Rapid7; endpoint protection; email security; identity and device management), make sure every critical system sends usable logs, and use AI to triage alerts and hunt across them.

• Secure AI and vibe-coding standards.

Set the rules for how teams build with AI: what can ship, what data AI tools may touch, and the review path before anything with customer data goes live.

• AI agent security.

As more of the company runs on agents and automations, secure them: scoped credentials and tool permissions, prompt-injection defense, data exposure, and monitoring and guardrails for agents in production.

Review high-risk agents before launch, including our own security agents.

Scope

This role protects our company, our platforms, our data and our brands.

For members' personal wallets and accounts outside our platforms, our role is education: helping members recognize and avoid scams.

• What you will bring
• Must have
• 10+ years in security, including 3+ years leading a security function as CISO, Head of Security or equivalent at a company of 100+ people.
• Has led live-incident response, not just tabletop exercises, including briefing executives during the incident.
• Has built or rebuilt a security program from an early stage: strategy, policy, tooling, training and incident response.
• AI-native operator.

Uses AI agents daily to do the work: writing detections, reviewing code and configs, reading vendor documentation, drafting policy.

Can show us the harnesses, workflows or automations you have built, and knows where AI stops and human judgment has to take over.

• Deep, current knowledge of AI-specific risks: prompt injection, over-scoped agent permissions, credential and data exposure through AI tools, and insecure AI-generated code.
• Hands-on with cloud security (AWS preferred), identity and access management, SIEM, endpoint protection and email security.
• Writes code: scripts, tooling and automation, not only vendor UIs.
• Experience in crypto, fintech or another high-fraud industry, and deep knowledge of phishing, social engineering and impersonation attacks.
• Can read the fine print: thorough with documentation, contracts and vendor security terms, and documents everything so nothing slips through.
• Briefs executives in plain language, trains non-technical staff, and writes policy people follow.
• Player-coach: comfortable spending about half your time hands-on while leading a small, fully remote team across many time zones.
• Nice to have
• Has prepared a company for SOC 2 or ISO 27001.
• Has secured or evaluated AI agents and LLM-based tools in production.
• Has run a third-party risk program covering financial data aggregators or similar providers.
• Has run a brand protection or takedown program.
• Experience with customer-facing security features such as account-takeover defense.
• Experience with risk quantification (FAIR or similar) and presenting to a board.
• Certifications such as CISSP, CISM, GCIH or OSCP.

What We Offer

• Competitive compensation package
• Independent Contractor opportunity
• Fully remote, globally distributed team
• Team offsites (Dubai, Costa Rica, etc.)
• Collaborative, forward-thinking culture that values innovation and results