Head of Cybersecurity Engineering 11/10/26

RedStone; Warszawa; Remote; PLN 335,000 - 446,000; Full time

Benefits offered by this job

Fully remote work

Private healthcare

Multisport card

Certifications budget

Token allocation after 3 months

Job summary

RedStone is seeking an senior cybersecurity leader to protect its AWS and cloud infrastructure, detect threats, perform pentests, and roll out practical OpSec standards across all teams. You will work hands-on with the CTO and collaborate with QA, Infrastructure, and Operations leadership.

The role targets production-critical systems in a fast-growing blockchain environment, emphasizing resilience, secure software delivery, and cutting-edge threat detection.

Qualifications

• 5+ years in cybersecurity, including 3+ years leading security for production-critical systems.
• Strong, hands-on knowledge of AWS security and cloud-service protection: IAM, Organizations and SCPs, VPC design, KMS, CloudTrail, WAF; securing containers (EKS/ECS) and serverless workloads
• Experience securing and operating critical financial infrastructure — a bank, exchange, payments, trading, custody or market-data system — where availability and integrity carry a direct financial cost
• Deep understanding of threat detection: building detections, running a SIEM or XDR platform, threat hunting and leading incident response
• Hands-on penetration-testing experience and fluency with standard pentest and cloud-security tooling; you can show what you would break and how
• A track record of designing and rolling out OpSec standards across a whole company — and getting non-engineers to follow them
• Comfortable writing Terraform, TypeScript scripts and GitHub Actions workflows to build controls yourself; you ship fixes, not tickets

Responsibilities

• AWS and cloud security — account structure and guardrails across the SaaS estate
• Threat detection and response — SIEM, detections, alerting, on-call escalation
• Penetration testing and offensive security — internal pentests and external audits
• Critical-infrastructure resilience — change control, dual control, break-glass, availability/SLOs
• Company-wide OpSec standards — governance across all teams
• Blockchain infrastructure security — keys, signing, multisig, on-chain monitoring
• AI in security operations — AI tooling for detection and triage
• Secure software delivery — branch protection, code-review gates, signed artifacts

Skills

Cybersecurity leadership

AWS security

Threat detection

Penetration testing

Security architecture

Tools

Terraform

TypeScript

GitHub Actions

Job description

RedStone is a blockchain company building the next generation of oracle infrastructure, delivering reliable, secure and low-latency data to blockchain applications. Today, our infrastructure powers 160+ protocols across DeFi, tokenized real-world assets (RWAs) and institutional blockchain applications, securing over $6.7B in Total Value Locked (TVL). Our products include modular Price Oracles, Proof of Reserve, Atom (OEV), Bolt (sub-second push) and RedStone Settle, designed for both decentralized and institutional use cases. RedStone is ISO/IEC 27001:2022 certified (SGS, UKAS-accredited) and has been audited 15+ times by Halborn, ABDK, PeckShield, Cantina and others. We are the official oracle partner of Securitize and work with institutions bringing BlackRock, Apollo, Hamilton Lane and Invesco products on-chain. Those clients treat our feeds as critical financial infrastructure, and this role exists to protect them to that standard.

The Role

You will lead cybersecurity at RedStone: protecting the AWS and cloud infrastructure that runs our data delivery services, detecting and responding to threats against it, testing it the way an attacker would, and rolling out operational-security standards that every team in the company actually follows.

You are a hands-on leader, not a policy author: you design the controls, build the detections, run the pentests yourself, and then bring the rest of the company along. This is a solo, senior role reporting to the CTO. You will work in cooperation with our CSO and in close partnership with the Head of QA and Technical Operations and the Head of Infrastructure, who own the systems and processes you protect.

What you will own

AWS and cloud security — account structure and guardrails (Organizations, SCPs), IAM and least privilege, network segmentation, KMS and Secrets Manager, CloudTrail and VPC Flow Logs, WAF; the same standard across our SaaS estate, built together with the Head of Infrastructure

Threat detection and response — the SIEM and detection pipeline; detections for what matters most to a blockchain oracle (unexpected signing activity, privilege changes, pipeline tampering, anomalous feed behaviour); alerting and on-call escalation; incident-response playbooks, tabletop exercises and post-mortems

Penetration testing and offensive security — a standing programme of internal pentests and red-team exercises against our AWS accounts, APIs, RPC endpoints, relayers and CI/CD; scoping and managing external pentests and audits; triaging Cantina bug-bounty findings and driving fixes

Critical-infrastructure resilience — controls for systems where downtime or compromise has a direct financial cost: change control for production and smart-contract deployments, dual control for sensitive operations, break-glass procedures, availability and latency SLOs, DDoS posture; run jointly with the Head of QA and Technical Operations

Company-wide OpSec standards — define and roll out operational-security standards across every team, not only engineering: device and endpoint baselines, identity and account hygiene, hardware-signer handling, travel and social-engineering protocols, phishing resilience, security onboarding and training; measure adoption and close the gaps

Blockchain infrastructure security — protecting the oracle nodes, on-chain relayers, RPC endpoints and push infrastructure that deliver our feeds across 70+ chains; signer and deployer keys (HSM, KMS), key ceremonies and rotation; multisig and admin-key controls for smart-contract deployments and upgrades; monitoring for anomalous on-chain activity against our contracts and feeds

AI in security operations — evaluate and adopt AI tooling for detection, triage and investigation where it beats rules alone, and secure our own use of AI tools and agents

Secure software delivery — branch protection, code-review gates, signed artifacts, dependency and secrets scanning in GitHub Actions, built with the Head of Infrastructure and the engineering leads

Requirements

5+ years in cybersecurity, including 3+ years leading security for production-critical systems

Strong, hands-on knowledge of AWS security and cloud-service protection: IAM, Organizations and SCPs, VPC design, KMS, CloudTrail, WAF; securing containers (EKS/ECS) and serverless workloads

Experience securing and operating critical financial infrastructure — a bank, exchange, payments, trading, custody or market-data system — where availability and integrity carry a direct financial cost

Deep understanding of threat detection: building detections, running a SIEM or XDR platform, threat hunting and leading incident response

Hands-on penetration-testing experience and fluency with standard pentest and cloud-security tooling; you can show what you would break and how

A track record of designing and rolling out OpSec standards across a whole company — and getting non-engineers to follow them

Comfortable writing Terraform, TypeScript scripts and GitHub Actions workflows to build controls yourself; you ship fixes, not tickets

Nice to have

Blockchain infrastructure experience: running oracle or validator nodes, relayers and RPC infrastructure; signing keys on HSMs, KMS, MPC or hardware signers; multisig and admin-key setups; smart-contract security and DeFi threat models

Hands-on experience with state-of-the-art AI tooling for threat detection and security operations — AI-assisted alert triage and investigation, anomaly detection, LLM-based agents for SecOps — and a clear view of where they help and where they don't

What we offer

Competitive B2B compensation: 30,000–40,000 PLN/month + VAT

Token allocation after 3 months of cooperation

Fully remote work, with the option to work from our office in the center of Warsaw

Private healthcare and Multisport card

Budget for certifications, conferences and security training

Company equipment and a hardware budget for the role

Technical interview — cloud and detection: walk through a representative AWS setup, show how you would attack it, and design the detection that would have caught you

Technical interview — leadership case: rolling out an OpSec standard across a 50-person remote company, plus blockchain-infrastructure and incident-response scenarios