Want to know if this job is worth applying to?
United States
Remote only
This position is listed on behalf of a partner company, which manages all applications and next steps. Our partner is looking for a Chief Information Security Officer (CISO) based in the United States.
Take the lead in building and overseeing the information security function for a growing, diversified financial services group operating across multiple brands and business lines. As the first Chief Information Security Officer, you will define the security strategy, establish the program, and take direct ownership of critical security decisions and incident response. This is a hands-on leadership role combining traditional security responsibilities with the development of AI-driven systems for continuous monitoring, testing, and auditing. You will protect cloud infrastructure, platforms, customer data, identities, vendors, and brand reputation while helping teams adopt AI securely. Working closely with group leadership and a small, globally distributed engineering team, you will translate complex risks into clear priorities and actionable decisions. Approximately half of your time will be dedicated to hands-on security execution, with the remainder focused on leadership, strategy, and building scalable security capabilities.
Define and own the information security strategy, roadmap, and budget across all brands and business units within the group.
Report security posture, emerging threats, key risks, and trends to group leadership through monthly briefings and actionable risk registers.
Lead incident response from detection and triage through containment, eradication, recovery, and post-incident reviews.
Coordinate incident response with legal counsel, forensic specialists, insurers, and regulators, maintaining up-to-date response procedures and conducting tabletop exercises.
Establish and maintain cloud security standards, particularly across AWS environments, and oversee identity and access management, including SSO, MFA, least-privilege access, administrative redundancy, and short-lived credentials.
Evaluate third-party vendors and data providers, review security audits and attestations, and define security requirements before vendors access company systems or data.
Establish security standards for customer-facing platforms, including login protection and account-takeover prevention, in collaboration with engineering teams.
Lead phishing prevention, email security, employee awareness training, and phishing simulations.
Manage brand protection initiatives by identifying and coordinating the removal of fraudulent domains and accounts impersonating company brands or leadership.
Develop and enforce practical security policies, support SOC 2 and ISO 27001 readiness with Legal and Compliance, and oversee public-facing security and trust communications.
Lead, mentor, and develop security engineers while determining which capabilities should be built internally, outsourced, or automated.
Provide security guidance for member scam-awareness communications in collaboration with Community, Support, and Marketing teams, with final wording subject to legal approval.
Build and maintain a comprehensive inventory of the organization's attack surface, including applications, cloud infrastructure, code repositories, SaaS platforms, integrations, data providers, access permissions, and logging coverage.
Design and operate AI-driven security systems and agentic workflows for automated code and dependency reviews, configuration audits, access reviews, and vendor documentation assessments.
Oversee the security technology stack, including SIEM, Rapid7, endpoint protection, email security, identity management, and device management, ensuring critical systems generate usable security logs.
Apply AI to alert triage, threat detection, and investigation while maintaining appropriate human oversight for critical decisions.
Establish secure AI development standards covering approved tools, permitted data access, code review, and release requirements for systems handling customer information.
Secure AI agents and business automations through scoped credentials, restricted tool permissions, prompt-injection defenses, data-exposure controls, and production monitoring.
Review high-risk AI agents before deployment, including internally developed security agents, and establish appropriate safeguards and operational controls.
10+ years of experience in information security, including at least 3 years leading a security function as a CISO, Head of Security, or equivalent within an organization of 100+ employees.
Demonstrated experience leading real-world security incidents, including executive communication and decision-making during active incidents.
Proven ability to establish or rebuild a security program from an early stage, covering strategy, policies, technology, employee training, and incident response.
Strong practical experience using AI agents and AI-powered tools in daily security operations, including detection development, code and configuration reviews, vendor documentation analysis, policy drafting, and automation.
Ability to demonstrate AI-driven security workflows, agentic systems, or automation frameworks, with sound judgment about where human oversight remains essential.
Deep and current understanding of AI-specific security risks, including prompt injection, excessive agent permissions, credential and data exposure through AI tools, and vulnerabilities in AI-generated code.
Hands-on expertise in cloud security, preferably AWS, as well as identity and access management, SIEM, endpoint protection, and email security.
Strong scripting and programming capabilities, with experience developing security tools, automation, and practical solutions beyond vendor interfaces.
Experience in crypto, fintech, or another high-fraud industry, with strong knowledge of phishing, social engineering, and impersonation attacks.
Excellent attention to detail and ability to assess technical documentation, contracts, vendor security requirements, and compliance evidence thoroughly.
Strong communication skills, including the ability to brief executives in plain language, train non-technical employees, and create security policies that teams can understand and follow.
Comfortable operating as a player-coach, dedicating approximately half of the role to hands-on execution while leading a small, fully remote team across multiple time zones.
Experience preparing organizations for SOC 2 or ISO 27001 certification is a plus.
Previous experience securing or evaluating AI agents and LLM-based tools in production is an advantage.
Experience managing third-party risk programs, particularly involving financial data aggregators or similar providers, is desirable.
Background in brand protection, fraud prevention, or domain and account takedown programs is beneficial.
Experience developing customer-facing security features, such as account-takeover prevention, is an advantage.
Familiarity with risk quantification methodologies such as FAIR and experience presenting security risks to a board are desirable.
Relevant certifications such as CISSP, CISM, GCIH, or OSCP are considered a plus.
Competitive compensation package.
Independent contractor engagement opportunity.
Fully remote working arrangement with a globally distributed team.
Opportunities to participate in team offsites in locations such as Dubai and Costa Rica.
Collaborative, forward-thinking work environment focused on innovation and results.
