Head of Blockchain Security

As Head of Blockchain Security at Bullish, you own and elevate the end-to-end security posture of the company's blockchain infrastructure, custody systems, and smart contract protocols. You operate as both a high-impact technical authority and a strategic partner to internal teams, protocol founders, and external security partners. Based in New York City, you work onsite at the office a minimum of 4 days per week and report to the Chief Information Security Officer.

What you'll do

• Lead deep-dive architectural reviews and security audits of smart contracts written in Solidity, Rust, and Move, focusing on protocol-level vulnerabilities, and oversee external third-party audits for high-complexity releases
• Produce clear, prioritized technical risk reports and serve as the primary security advisor to protocol founders, engineering leads, and executive leadership, translating complex risks into actionable decisions
• Build, deploy, and maintain robust blockchain monitoring, alerting, and automated detection systems across major ecosystems
• Design and operate automated emergency exit workflows to protect protocol assets under adverse market or security conditions, and facilitate cross-industry incident response tabletop exercises
• Conduct rigorous technical assessments of external institutional custody systems, internal treasury controls, and third-party vendor infrastructure
• Build repeatable security frameworks and processes that enable the security program to scale alongside organizational growth

What you bring

• 7+ years of experience in cybersecurity, with 5+ years dedicated specifically to blockchain and smart contract security
• Hands-on experience assessing smart contracts written in Solidity, Rust, and/or Move
• Strong background in C/C++, Linux, and cloud-native architectures (AWS, Azure, GCP)
• Proven background in senior-level penetration testing, application security, offensive security methodologies, design reviews, and threat modeling (OWASP Top 10, SANS CWE 25)
• Deep expertise in applied cryptography (PKI, algorithms, encryption at rest and in transit) and network and protocol fundamentals (IP, DNS, HTTP, SSL/TLS)
• Strong working knowledge of institutional custody infrastructure and major DeFi protocols across Ethereum, Solana, Stacks, and Sui
• Ability to articulate critical risks concisely to technical teams and non-technical stakeholders alike, with outstanding self-management and operational autonomy across global time zones

Nice to have

• Offensive security certifications (OSCP, OSWE, OSCE) or related credentials
• Track record of public security research, published vulnerability papers, or presentations at major industry conferences

What we offer

• Base salary of $260,000-$275,000 plus discretionary annual target bonus and performance incentives/benefits
• Onsite role in New York City, 4+ days per week

About Bullish

Bullish is an institutionally focused global digital asset platform providing market infrastructure and information services. The company operates Bullish Exchange, a regulated spot and derivatives exchange in Germany, Hong Kong, and Gibraltar; CoinDesk Indices, a collection of proprietary and single-asset benchmarks; CoinDesk Data, a suite of market data and analytics; and CoinDesk Insights, a digital media platform covering news and insights about digital assets, markets, policy, and blockchain technology.