Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 7 hours ago

Chief Information Security Officer

Decentralized Masters

Where
Rio de Janeiro, RJ, Brazil
Work mode
Remote
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowChief Information Security OfficerDecentralized Masters · Rio de Janeiro, RJ, Brazil

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on Decentralized Masters's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

13.5% of postings close within 7 days. Measured by our own scanner across the market.

Share of postings closed within
  1. 2.3%1 day
  2. 4.6%3 days
  3. 13.5%7 days
  4. 21.8%14 days
  5. 36.6%30 days
  6. 58.9%60 days
This job: posted 7 hours ago

The posting

Who We Are

Catalyst Capital is a profitable, bootstrapped holding company building a diversified financial services group: education, publishing, software, wealth and tax planning tools, investment products and proprietary trading technology. Funded entirely from its own operating cash. We have never taken outside capital.

The cash engine is Decentralized Masters, a DeFi education business that went from zero to 150+ people, 4,500+ paying members and roughly $48.6M of FY26 revenue at ~25% earnings before tax in four years. That engine funds everything else on this page.

Role summary

Catalyst Capital is hiring its first Chief Information Security Officer to own security across every brand in the group. You will set the strategy, build the program, and personally run the response when something goes wrong.

The job is two halves. Half is the core of a CISO's role: incident response, identity and access, vendor risk, phishing defense, policy and audit readiness, and the judgment calls only a person can own. The other half is making security AI-driven: mapping our full surface and building agentic systems that test, monitor and audit it with near-total coverage, so security keeps pace as more of the company runs on AI. This is a player-coach role: about half hands-on, leading a small team of engineers.

You report to Group leadership, brief the leadership team monthly, and are the person they trust to explain risk in plain language and make the call under pressure.

What you will own

Core security leadership (about half)

  • Security strategy and program. Own the security strategy, roadmap and budget across Decentralized Masters, Legacy, Inflection Club, Sentinelis and future brands. Report posture, top risks and trends to leadership every month, with a risk register leadership can act on.
  • Incident response. Own IR end to end: detection, triage, containment, eradication, recovery and the postmortem. Lead the room during a live incident and coordinate with legal counsel, forensics firms, insurers and regulators. Keep runbooks current and run tabletop exercises.
  • Cloud and identity security. Own identity and access across the group: SSO, MFA, least-privilege roles, admin redundancy and short-lived credentials. Set the AWS security baseline.
  • Third-party and vendor risk. Assess the security of every vendor and data provider we depend on, including their audits and attestations, and set the bar a vendor must clear before connecting to our systems or data.
  • Platform and customer account security. Set the standards for login protection and account-takeover defense on our platforms, and work with the engineering teams that own each platform to build them in.
  • Phishing and impersonation defense. Own email security, staff training and phishing simulations. Run brand protection: find and take down fake domains and accounts impersonating our brands and leaders.
  • Policy, compliance and trust. Write and enforce policies people actually follow. Prepare the company for SOC 2 or ISO 27001 with Legal & Compliance. Own the public security and trust story, including the trust page on our products.
  • Team leadership. Manage and develop our security engineers, decide what we build in-house versus outsource, and grow the team only where automation cannot do the job.
  • Member scam awareness. Supply the security content behind scam-awareness messaging to members, working with Community, Support and Marketing. Legal approves the wording.

AI-driven security (about half)

  • Full attack-surface map. Build and maintain a living inventory of everything we run: internal apps, cloud, code repos, and every SaaS tool and integration (CRM, telephony, community, payments, data providers). Know what connects to what, who has access, and what is logged.
  • Agentic security harness. Design and run AI-driven systems that approach 100% coverage: automated code and dependency review, continuous configuration and access audits, and vendor documentation review. Humans set direction and make the judgment calls; agents do the exhaustive work.
  • AI-driven detection and logging. Own the security stack (SIEM, Rapid7; endpoint protection; email security; identity and device management), make sure every critical system sends usable logs, and use AI to triage alerts and hunt across them.
  • Secure AI and vibe-coding standards. Set the rules for how teams build with AI: what can ship, what data AI tools may touch, and the review path before anything with customer data goes live.
  • AI agent security. As more of the company runs on agents and automations, secure them: scoped credentials and tool permissions, prompt-injection defense, data exposure, and monitoring and guardrails for agents in production. Review high-risk agents before launch, including our own security agents.

Scope

This role protects our company, our platforms, our data and our brands. For members' personal wallets and accounts outside our platforms, our role is education: helping members recognize and avoid scams.

Requirements

What you will bring

Must have

  • 10+ years in security, including 3+ years leading a security function as CISO, Head of Security or equivalent at a company of 100+ people.
  • Has led live-incident response, not just tabletop exercises, including briefing executives during the incident.
  • Has built or rebuilt a security program from an early stage: strategy, policy, tooling, training and incident response.
  • AI-native operator. Uses AI agents daily to do the work: writing detections, reviewing code and configs, reading vendor documentation, drafting policy. Can show us the harnesses, workflows or automations you have built, and knows where AI stops and human judgment has to take over.
  • Deep, current knowledge of AI-specific risks: prompt injection, over-scoped agent permissions, credential and data exposure through AI tools, and insecure AI-generated code.
  • Hands-on with cloud security (AWS preferred), identity and access management, SIEM, endpoint protection and email security.
  • Writes code: scripts, tooling and automation, not only vendor UIs.
  • Experience in crypto, fintech or another high-fraud industry, and deep knowledge of phishing, social engineering and impersonation attacks.
  • Can read the fine print: thorough with documentation, contracts and vendor security terms, and documents everything so nothing slips through.
  • Briefs executives in plain language, trains non-technical staff, and writes policy people follow.
  • Player-coach: comfortable spending about half your time hands-on while leading a small, fully remote team across many time zones.

Nice to have

  • Has prepared a company for SOC 2 or ISO 27001.
  • Has secured or evaluated AI agents and LLM-based tools in production.
  • Has run a third-party risk program covering financial data aggregators or similar providers.
  • Has run a brand protection or takedown program.
  • Experience with customer-facing security features such as account-takeover defense.
  • Experience with risk quantification (FAIR or similar) and presenting to a board.
  • Certifications such as CISSP, CISM, GCIH or OSCP.

Benefits

What We Offer

  • Competitive compensation package
  • Independent Contractor opportunity
  • Fully remote, globally distributed team
  • Team offsites (Dubai, Costa Rica, etc.)
  • Collaborative, forward-thinking culture that values innovation and results
From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against Decentralized Masters's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on Decentralized Masters's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    Decentralized Masters's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.