Chief Information Security Officer

Decentralized Masters; United States; Remote; USD 180,000 - 360,000; Full time

Job summary

Catalyst Capital is hiring its first Chief Information Security Officer to own security across every brand in the group. You will set the strategy, build the program, and personally run the response when something goes wrong.

The role combines core CISO responsibilities—incident response, identity and access, vendor risk, phishing defense, policy and audit readiness—with an AI-driven security approach to map surfaces and build agentic systems that test, monitor and audit risk, while leading a

Qualifications

• Security leadership experience preferred.
• Ability to translate risk to non-technical leadership.
• Experience building or managing security programs.

Responsibilities

• Own security strategy, program and budget across multiple brands.
• Lead incident response end-to-end including coordination with external partners.
• Manage cloud and identity security, including access controls and baseline configurations.
• Assess third-party and vendor risk and ensure audits and attestations are in place.
• Define login protection standards and implement phishing defenses across platforms.
• Write and enforce security policies and prepare for SOC 2 / ISO 27001 readiness.

Job description

Who We Are

Catalyst Capital is a profitable, bootstrapped holding company building a diversified financial services group: education, publishing, software, wealth and tax planning tools, investment products and proprietary trading technology. Funded entirely from its own operating cash. We have never taken outside capital.The cash engine is Decentralized Masters, a DeFi education business that went from zero to 150+ people, 4,500+ paying members and roughly $48.6M of FY26 revenue at ~25% earnings before tax in four years. That engine funds everything else on this page.

Role summary

Catalyst Capital is hiring its first Chief Information Security Officer to own security across every brand in the group. You will set the strategy, build the program, and personally run the response when something goes wrong.

The job is two halves. Half is the core of a CISO's role: incident response, identity and access, vendor risk, phishing defense, policy and audit readiness, and the judgment calls only a person can own. The other half is making security AI-driven: mapping our full surface and building agentic systems that test, monitor and audit it with near-total coverage, so security keeps pace as more of the company runs on AI. This is a player-coach role: about half hands-on, leading a small team of engineers.

You report to Group leadership, brief the leadership team monthly, and are the person they trust to explain risk in plain language and make the call under pressure.

What you will own

• Core security leadership (about half)Security strategy and program. Own the security strategy, roadmap and budget across Decentralized Masters, Legacy, Inflection Club, Sentinelis and future brands. Report posture, top risks and trends to leadership every month, with a risk register leadership can act on.
• Incident response. Own IR end to end: detection, triage, containment, eradication, recovery and the postmortem. Lead the room during a live incident and coordinate with legal counsel, forensics firms, insurers and regulators. Keep runbooks current and run tabletop exercises.
• Cloud and identity security. Own identity and access across the group: SSO, MFA, least-privilege roles, admin redundancy and short-lived credentials. Set the AWS security baseline.
• Third-party and vendor risk. Assess the security of every vendor and data provider we depend on, including their audits and attestations, and set the bar a vendor must clear before connecting to our systems or data.
• Platform and customer account security. Set the standards for login protection and account-takeover defense on our platforms, and work with the engineering teams that own each platform to build them in.
• Phishing and impersonation defense. Own email security, staff training and phishing simulations. Run brand protection: find and take down fake domains and accounts impersonating our brands and leaders.
• Policy, compliance and trust. Write and enforce policies people actually follow. Prepare the company for SOC 2 or ISO 27001 wit