Chief Information Security Officer

Job4Travelers; Chicago (IL); Remote; USD 150,000 - 350,000; Full time

Benefits offered by this job

Fully remote, globally distributed

Competitive compensation package

Travel offsites to exotic locations

Job summary

Catalyst Capital is hiring its first Chief Information Security Officer to own security across every brand in the group. You will set strategy, build the program, and personally run responses when needed.

The role blends core CISO work with AI-driven security, including building an attack-surface map and agentic systems. It is a player-coach role with a small, fully remote team across time zones.

Qualifications

• 10+ years in security, including leadership roles at scale.
• Led live incident response and coordinated executives during incidents.
• Built or rebuilt security programs with strategy, policy, tooling and IR.
• AI-native operator with daily use of AI for security tasks.
• Deep knowledge of AI risks and prompt-injection defense is beneficial.

Responsibilities

• Define security strategy, roadmap and budget across multiple brands.
• Own incident response end-to-end, lead IR during live incidents and run postmortems.
• Manage cloud security, identity and access administration and baseline AWS security.
• Assess third-party/vendor risk and ensure required audits/attestations.
• Set login protection standards and collaborate with engineering on implementations.
• Lead phishing defense, staff training and impersonation protection.
• Write and enforce policies, preparing the company for SOC 2/ISO 27001.
• Lead a small, distant security team and balance in-house vs outsourced work.
• Develop member security content and coordinate with Legal/Compliance.

Skills

Incident response

Cloud security

IAM / MFA

Vendor risk

AI security

Team leadership

Executive briefing

Policy & compliance

Threat modeling

Security strategy

Tools

SIEM

AWS security

Endpoint protection

Identity management

Job description

Remote CISO at Catalyst Capital - Global Contract — Remote

Location & Contract Setup: This is a fully remote, globally distributed independent contractor role — one of the most nomad-friendly structures possible. As a contractor, you're responsible for your own taxes and compliance, which actually gives you more flexibility to operate from virtually any country without an employer needing to establish local payroll.

Timezone & Schedule Flexibility: The role requires leading a small team across many time zones, briefing leadership monthly, and being available to run live incident response. This means you need reliable, fast internet at all times and must be reachable during crises — not strictly async. Expect some fixed overlap hours with the leadership team, likely aligned to US or European business hours.

Nomad Destination Fit: Without a stated salary, cost-of-living comparisons are approximate, but CISO-level contractor rates typically range $150K–$350K+ USD annually. At those rates:

• Lisbon, Portugal — High quality of life, D8 Digital Nomad Visa available, ~$3,000–$4,500/mo living costs.
• Medellín, Colombia — Very affordable (~$1,800–$2,800/mo), fast fiber internet, growing tech scene.
• Chiang Mai, Thailand — Budget-friendly (~$1,200–$2,000/mo), but check timezone overlap needs carefully (UTC+7).

Travel Perks: Team offsites in locations like Dubai and Costa Rica are a standout perk — expect 1-2 paid company gatherings per year, which doubles as built-in travel experiences. No coworking stipend is mentioned explicitly.

Who We Are

Catalyst Capital is a profitable, bootstrapped holding company building a diversified financial services group: education, publishing, software, wealth and tax planning tools, investment products and proprietary trading technology. Funded entirely from its own operating cash — we have never taken outside capital.

The cash engine is Decentralized Masters, a DeFi education business that went from zero to 150+ people, 4,500+ paying members and roughly $48.6M of FY26 revenue at ~25% earnings before tax in four years. That engine funds everything else.

Role Summary

Catalyst Capital is hiring its first Chief Information Security Officer to own security across every brand in the group. You will set the strategy, build the program, and personally run the response when something goes wrong.

The job is two halves. Half is core CISO work: incident response, identity and access, vendor risk, phishing defense, policy and audit readiness, and the judgment calls only a person can own. The other half is making security AI-driven: mapping our full attack surface and building agentic systems that test, monitor and audit it with near-total coverage, so security keeps pace as more of the company runs on AI.

This is a player-coach role — about half hands-on — leading a small team of engineers. You report to Group leadership, brief the leadership team monthly, and are the person they trust to explain risk in plain language and make the call under pressure.

What You Will Own

Core Security Leadership (about half)

• Security strategy and program. Own the security strategy, roadmap and budget across Decentralized Masters, Legacy, Inflection Club, Sentinelis and future brands. Report posture, top risks and trends to leadership every month, with a risk register leadership can act on.
• Incident response. Own IR end to end: detection, triage, containment, eradication, recovery and the postmortem. Lead the room during a live incident and coordinate with legal counsel, forensics firms, insurers and regulators. Keep runbooks current and run tabletop exercises.
• Cloud and identity security. Own identity and access across the group: SSO, MFA, least-privilege roles, admin redundancy and short-lived credentials. Set the AWS security baseline.
• Third-party and vendor risk. Assess the security of every vendor and data provider, including their audits and attestations, and set the bar a vendor must clear before connecting to our systems or data.
• Platform and customer account security. Set the standards for login protection and account-takeover defense on our platforms, and work with engineering teams to build them in.
• Phishing and impersonation defense. Own email security, staff training and phishing simulations. Run brand protection: find and take down fake domains and accounts impersonating our brands and leaders.
• Policy, compliance and trust. Write and enforce policies people actually follow. Prepare the company for SOC 2 or ISO 27001 with Legal & Compliance. Own the public security and trust story, including the trust page on our products.
• Team leadership. Manage and develop our security engineers, decide what we build in-house versus outsource, and grow the team only where automation cannot do the job.
• Member scam awareness. Supply the security content behind scam-awareness messaging to members, working with Community, Support and Marketing. Legal approves the wording.

AI-Driven Security (about half)

• Full attack-surface map. Build and maintain a living inventory of everything we run: internal apps, cloud, code repos, and every SaaS tool and integration (CRM, telephony, community, payments, data providers). Know what connects to what, who has access, and what is logged.
• Agentic security harness. Design and run AI-driven systems that approach 100% coverage: automated code and dependency review, continuous configuration and access audits, and vendor documentation review. Humans set direction and make the judgment calls; agents do the exhaustive work.
• AI-driven detection and logging. Own the security stack (SIEM, Rapid7; endpoint protection; email security; identity and device management), ensure every critical system sends usable logs, and use AI to triage alerts and hunt across them.
• Secure AI and vibe-coding standards. Set the rules for how teams build with AI: what can ship, what data AI tools may touch, and the review path before anything with customer data goes live.
• AI agent security. As more of the company runs on agents and automations, secure them: scoped credentials and tool permissions, prompt-injection defense, data exposure, and monitoring and guardrails for agents in production. Review high-risk agents before launch, including our own security agents.

Scope

This role protects our company, our platforms, our data and our brands. For members' personal wallets and accounts outside our platforms, our role is education: helping members recognize and avoid scams.

Must Have

• 10+ years in security, including 3+ years leading a security function as CISO, Head of Security or equivalent at a company of 100+ people.
• Has led live-incident response — not just tabletop exercises — including briefing executives during the incident.
• Has built or rebuilt a security program from an early stage: strategy, policy, tooling, training and incident response.
• AI-native operator: uses AI agents daily to do the work (writing detections, reviewing code and configs, reading vendor documentation, drafting policy). Can show workflows or automations built, and knows where AI stops and human judgment takes over.
• Deep, current knowledge of AI-specific risks: prompt injection, over-scoped agent permissions, credential and data exposure through AI tools, and insecure AI-generated code.
• Hands-on with cloud security (AWS preferred), identity and access management, SIEM, endpoint protection and email security.
• Writes code: scripts, tooling and automation — not only vendor UIs.
• Experience in crypto, fintech or another high-fraud industry, with deep knowledge of phishing, social engineering and impersonation attacks.
• Can read the fine print: thorough with documentation, contracts and vendor security terms, and documents everything so nothing slips through.
• Briefs executives in plain language, trains non-technical staff, and writes policy people follow.
• Player-coach: comfortable spending about half your time hands-on while leading a small, fully remote team across many time zones.

Nice to Have

• Has prepared a company for SOC 2 or ISO 27001.
• Has secured or evaluated AI agents and LLM-based tools in production.
• Has run a third-party risk program covering financial data aggregators or similar providers.
• Has run a brand protection or takedown program.
• Experience with customer-facing security features such as account-takeover defense.
• Experience with risk quantification (FAIR or similar) and presenting to a board.
• Certifications such as CISSP, CISM, GCIH or OSCP.

What We Offer

• Competitive compensation package
• Fully remote, globally distributed team
• Collaborative, forward-thinking culture that values innovation and results

Is this a fully remote position or are there office requirements? This is a fully remote, globally distributed role with no stated office requirements. The team operates across many time zones, and the role is structured as an independent contractor engagement. What is the employment structure for this CISO role? This is an independent contractor opportunity, not a full-time employee position. You will be responsible for your own taxes, benefits, and compliance as a self‑employed professional. What industries or domain experience is required? The job description explicitly requires experience in crypto, fintech, or another high-fraud industry, along with deep knowledge of phishing, social engineering, and impersonation attacks. Does this role require AI experience or just traditional security skills? Both are required. The role is split roughly 50/50 between core CISO responsibilities and building AI‑driven security systems, including agentic harnesses, prompt‑injection defense, and securing LLM‑based tools in production. Are there travel requirements for this remote role? Team offsites are part of the culture, with past examples including Dubai and Costa Rica. These are listed as a benefit rather than a mandatory requirement, but participation is implied.

Helping travelers find remote work and build location‑independent careers around the world.