Director, Senior Security Architect

As Director, Senior Security Architect at Bullish, you sit at the intersection of cutting-edge engineering and high-stakes finance, shaping how secure software is built across web, API, mobile, and FIX platforms. You lead the Security Architecture team that secures Bullish Global, including the Bullish Exchange, Bullish Liquidity Services, CoinDesk Indices, CoinDesk Data, CoinDesk Media, and CoinDesk Events, designing defenses that keep mission-critical trading systems resilient against the most capable adversaries. This is a senior technical leadership role where you influence through deep expertise and mentorship, solving complex technical challenges in the crypto landscape.

What you'll do

• Build complex threat models for critical systems and establish industry-leading cybersecurity requirements to turn ambiguity into clear, prioritized defenses.
• Partner closely with Product, Engineering, and Infrastructure teams to design and ship secure software across web, API, mobile, FIX, and trading platforms.
• Lead complex global security initiatives and build custom AI-powered tooling to maximize efficiency and scale the cybersecurity program.
• Assess vulnerability risks, deliver actionable recommendations across all technical levels, and track health metrics and KPIs for executive reporting.
• Drive high-impact projects and adapt to evolving business needs.
• Provide technical leadership and mentorship to the cybersecurity and engineering teams.

What you bring

• 10+ years in cybersecurity, including 5+ years of hands-on coding, alongside deep expertise in threat modeling, code reviews, and offensive security methodologies.
• Solid working knowledge of Linux environments, including command-line proficiency, shell scripting, system hardening, and security configuration.
• Hands-on experience in penetration testing.
• Strong foundation in network protocols (IP, DNS, HTTP, SSL/TLS), cryptography (PKI, encryption at rest and in motion), and public cloud platforms (AWS, Azure, or GCP).
• Proficiency in programming languages such as C/C++, Java, JavaScript, Python, Go, or Rust.
• Deep understanding of common vulnerability frameworks (OWASP Top 10, SANS CWE Top 25).
• Solid grasp of enterprise software development, Agile, CI/CD pipelines, and security tooling (SAST, DAST, OSA, Vulnerability Management, API traceability).
• Excellent ability to convey complex technical risks to non-technical executives and engineers and build strong cross-functional partnerships.
• Strong individual contributor with ability to drive projects independently from conception to completion with minimal oversight.

Nice to have

• A restless drive to secure systems and continuously learn new technologies.
• Current holder of Offensive Security Certified Professional (OSCP) certification.
• Experience securing trading, financial-market, or other regulated, high-stakes systems.
• Additional relevant certifications such as security architecture certifications (SABSA, TOGAF), offensive security certifications (CISSP, OSCE, SANS, CREST, CISM), or cloud security specialty certifications (AWS, Azure, or GCP).

What we offer

• Full-time onsite position based in SoHo, London.

About Bullish and CoinDesk

Bullish is a regulated digital assets exchange. In November 2023, Bullish acquired CoinDesk, the leading media, events, indices, and data company for the global crypto economy since 2013. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence, delivering award-winning journalism and hosting Consensus, the world's largest crypto festival.