SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Hashgraph is a fast-growing software company supporting Hedera, an open-source, proof-of-stake platform designed for enterprise and web3 applications. Hedera is EVM-compatible and governed by industry-leading organizations across 11 sectors and 14 regions.
You will serve as Head of Security for a digital asset trading platform operating as a business unit within Hashgraph. This role combines strategic security leadership with hands-on execution, reporting directly to executive leadership with visibility across the organization.
Key responsibilities:
- Develop and own the security strategy, policy framework, and risk management program for the business unit. Establish governance structures including escalation paths, risk registers, exception processes, and metrics-driven reporting for executives and external stakeholders.
- Determine which certifications, attestations, and regulatory frameworks are required (SOC 2, ISO 27001, etc.) and drive them to completion. Align the program with regulatory requirements across jurisdictions where the business operates. Serve as primary security contact for regulators, auditors, institutional partners, and banking counterparties.
- Oversee custody, wallet infrastructure, and key management operations, including hot, warm, and cold wallet security.
- Govern smart contract security through audit requirements, bug bounty programs, and secure release gates. Ensure secure architecture for trading, matching, settlement, and withdrawal flows. Drive secure SDLC, vulnerability management, and application security practices.
- Own security monitoring and incident response. Develop crisis playbooks for exploits, key compromise, and market-impacting events. Conduct tabletop exercises, red team engagements, and penetration testing. Coordinate with legal, compliance, communications, and executive leadership on regulatory notifications and public disclosures. Oversee business continuity and disaster recovery planning.
- Lead a small security team combining direct execution with tooling, partners, and shared services. Manage the security budget, tooling strategy, and vendor relationships. Partner with engineering, product, legal, and finance to embed security into company operations. Define the function's growth trajectory and hiring strategy.
Success in 6-12 months means: a functioning governance framework with risk register and exception process; completed certifications and regulatory frameworks; written incident playbooks with at least one tabletop exercise completed; and a staffing plan for the function.
Requirements:
- 10+ years in information security, including 5+ years in senior security leadership
- Direct security leadership experience at a centralized exchange (CEX), decentralized exchange (DEX), or comparable digital asset trading or custody platform, including leading incident response through a material security event
- Track record designing and running security governance programs covering policy, risk, audit, and executive reporting; building or operating compliance and assurance programs
- Strong understanding of crypto-native threats: private key compromise, smart contract exploits, oracle and bridge attacks, front-end and supply chain compromise, insider risk, social engineering
- Working knowledge of key management and custody models (HSM, MPC, multisig) and blockchain protocol fundamentals
- Judgment to decide which frameworks and certifications are warranted for a given stage and market
- Practical judgment about what a lean function should build versus draw from shared services, tooling, and partners
- Technical judgment balanced with program-level governance in a senior, hands-on role
- Comfort working in lean teams and matrixed environments
- Clear communication with engineers, executives, regulators, and auditors
Preferred:
- Regulatory engagement across multiple jurisdictions (US, EU, UAE, APAC)
- Background in smart contract security, DeFi protocol risk, or on-chain monitoring and forensics
- Experience standing up a security function in a newer or fast-scaling business unit
- Familiarity with DevSecOps and application security posture management
- Relevant certifications: CISSP, CISM, CISA, or CCSP
- Contributions to industry standards bodies, ISACs, or open security communities
