Chief Information Security Officer (AI Security)

Location: Remote. Listed locations: Miami, Florida, United States; Berlin, Germany; Amsterdam, Netherlands; London, United Kingdom; Rio de Janeiro, Brazil.

Catalyst Capital is a profitable, bootstrapped holding company building a diversified financial services group spanning education, publishing, software, wealth and tax planning tools, investment products, and proprietary trading technology; hirify.global is its DeFi education business.

What you will do

• Own security strategy, roadmap, budget, risk reporting, policy, audit readiness, and trust communications across all group brands.
• Lead incident response from detection through recovery and postmortem, coordinating with legal counsel, forensics firms, insurers, and regulators.
• Own cloud, identity and access, vendor risk, platform security, phishing defense, brand protection, and member scam-awareness content.
• Manage and develop a small security engineering team while deciding which capabilities to build internally or outsource.
• Build a living inventory of applications, cloud resources, repositories, SaaS tools, integrations, access, and logging.
• Design AI-driven security systems for automated code, dependency, configuration, access, vendor, detection, and logging reviews; secure AI agents, prompt handling, credentials, data, and production guardrails.

Requirements

• 10+ years in security, including 3+ years leading a security function as a CISO, Head of Security, or equivalent at a company of 100+ people.
• Experience leading live incident response, including executive briefings during incidents.
• Experience building or rebuilding an early-stage security program covering strategy, policy, tooling, training, and incident response.
• Daily AI-native operating experience using agents for detections, code and configuration review, vendor documentation, and policy work; ability to demonstrate built harnesses, workflows, or automations and identify where human judgment is required.
• Current knowledge of prompt injection, over-scoped agent permissions, credential and data exposure through AI tools, and insecure AI-generated code.
• Hands-on experience with cloud security, preferably AWS, identity and access management, SIEM, endpoint protection, and email security.
• Ability to write scripts, tooling, and automation rather than relying only on vendor interfaces.
• Experience in crypto, fintech, or another high-fraud industry, with deep knowledge of phishing, social engineering, and impersonation attacks.
• Strong documentation, vendor contract and security-term review, executive communication, non-technical training, and policy-writing skills.
• Player-coach approach: comfortable spending about half the time hands-on while leading a small fully remote team across many time zones.

Nice to have

• Preparation for SOC 2 or ISO 27001.
• Experience securing or evaluating AI agents and LLM-based tools in production.
• Experience running third-party risk programs for financial data aggregators or similar providers.
• Brand protection or takedown program experience.
• Experience with customer-facing security features such as account-takeover defense.
• Risk quantification experience, such as FAIR, and board presentations.
• CISSP, CISM, GCIH, OSCP, or similar certifications.

Culture & Benefits

• Independent Contractor opportunity.
• Fully remote, globally distributed team.
• Competitive compensation package.
• Team offsites in locations including Dubai and Costa Rica.
• Collaborative, forward-thinking culture focused on innovation and results.