Chief Information Security Officer

Who We Are Catalyst Capital is a profitable, bootstrapped holding company building a diversified financial services group: education, publishing, software, wealth and tax planning tools, investment products and proprietary trading technology. Funded entirely from its own operating cash. We have never taken outside capital. The cash engine is Decentralized Masters, a DeFi education business that went from zero to 150+ people, 4,500+ paying members and roughly $48.6M of FY26 revenue at ~25% earnings before tax in four years. That engine funds everything else on this page. Role summary Catalyst Capital is hiring its first Chief Information Security Officer to own security across every brand in the group. You will set the strategy, build the program, and personally run the response when something goes wrong. The job is two halves. Half is the core of a CISO's role: incident response, identity and access, vendor risk, phishing defense, policy and audit readiness, and the judgment calls only a person can own. The other half is making security AI-driven: mapping our full surface and building agentic systems that test, monitor and audit it with near-total coverage, so security keeps pace as more of the company runs on AI. This is a player-coach role: about half hands-on, leading a small team of engineers. You report to Group leadership, brief the leadership team monthly, and are the person they trust to explain risk in plain language and make the call under pressure. What you will own Core security leadership (about half) • Security strategy and program. Own the security strategy, roadmap and budget across Decentralized Masters, Legacy, Inflection Club, Sentinelis and future brands. Report posture, top risks and trends to leadership every month, with a risk register leadership can act on. • Incident response. Own IR end to end: detection, triage, containment, eradication, recovery and the postmortem. Lead the room during a live incident and coordinate with legal counsel, forensics firms, insurers and regulators. Keep runbooks current and run tabletop exercises. • Cloud and identity security. Own identity and access across the group: SSO, MFA, least-privilege roles, admin redundancy and short-lived credentials. Set the AWS security baseline. • Third-party and vendor risk. Assess the security of every vendor and data provider we depend on, including their audits and attestations, and set the bar a vendor must clear before connecting to our systems or data. • Platform and customer account security. Set the standards for login protection and account-takeover defense on our platforms, and work with the engineering teams that own each platform to build them in. • Phishing and impersonation defense. Own email security, staff training and phishing simulations. Run brand protection: find and take down fake domains and accounts impersonating our brands and leaders. • Policy, compliance and trust. Write and enforce policies people actually follow. Prepare the company for SOC 2 or ISO 27001 with Legal & Compliance. Own the public security and trust story, including the trust page on our products. • Team leadership. Manage and develop our security engineers, decide what we build in-house versus outsource, and grow the team only where automation cannot do the job. • Member scam awareness. Supply the security content behind scam-awareness messaging to members, working with Community, Support and Marketing. Legal approves the wording. AI-driven security (about half) • Full attack-surface map. Build and maintain a living inventory of everything we run: internal apps, cloud, code repos, and every SaaS tool and integration (CRM, telephony, community, payments, data providers). Know what connects to what, who has access, and what is logged. • Ag