Head of Security

As Head of Security at Hashgraph, you build and lead the security function for a digital asset trading platform operating as its own business unit. You set security strategy, own the policy framework and risk management program, and ensure that user funds, platform infrastructure, and governance earn the trust of regulators and institutional partners alongside an established shared security organization.

What you'll do

• Set the security strategy and own the policy framework and risk management program for the business unit, including governance, escalation paths, risk registers, risk acceptance and exception processes, and metrics-driven reporting for executives and external stakeholders. You are the accountable owner for the business unit's security posture.
• Decide which certifications, attestations, and regulatory frameworks the business needs, then carry them through to completion. Align the program with regulatory requirements in jurisdictions where the business operates, manage third-party and vendor risk, and serve as the primary security contact for regulators, auditors, institutional partners, and banking counterparties.
• Oversee custody, wallet infrastructure, key management, and hot, warm, and cold wallet operations.
• Govern smart contract security through audit requirements, bug bounty programs, and secure release gates. Ensure the architecture behind trading, matching, settlement, and withdrawal flows is secure, and drive secure SDLC, vulnerability management, and application security practices.
• Own security monitoring and incident response, including crisis playbooks for exploits, key compromise, and market-impacting events. Run tabletop exercises, red team engagements, and penetration testing, coordinate with legal, compliance, communications, and executive leadership for regulatory notification or public disclosure, and oversee business continuity and disaster recovery planning as it relates to security.
• Lead a small security function that combines direct execution with tooling, partners, and shared services. Manage the security budget, tooling strategy, and vendor relationships. Partner with engineering, product, legal, and finance to embed security into how the company builds and operates, and define how the function should grow as the business scales.

What you bring

• 10+ years in information security, including 5+ years in senior security leadership.
• Direct security leadership experience at a centralized exchange (CEX), decentralized exchange (DEX), or comparable digital asset trading or custody platform, including leading incident response through a material security event.
• A track record designing and running security governance programs covering policy, risk, audit, and executive reporting, and building or operating compliance and assurance programs.
• Strong understanding of crypto-native threats, including private key compromise, smart contract exploits, oracle and bridge attacks, front-end and supply chain compromise, insider risk, and social engineering.
• Working knowledge of key management and custody models (HSM, MPC, multisig) and blockchain protocol fundamentals.
• Judgment to decide which frameworks and certifications are warranted for a given stage and market.
• Practical judgment about what a lean function should build itself and what it should draw from shared services, tooling, and partners.
• Technical judgment balanced with program-level governance, in a senior, hands-on role with direct visibility to executive leadership.
• Comfort working in a lean team and a matrixed environment.
• The ability to communicate clearly with engineers, executives, regulators, and auditors.

Nice to have

• Regulatory engagement across multiple jurisdictions (US, EU, UAE, APAC).
• Background in smart contract security, DeFi protocol risk, or on-chain monitoring and forensics.
• Experience standing up a security function inside a newer or fast-scaling business unit.
• Familiarity with DevSecOps and application security posture management.
• Relevant certifications such as CISSP, CISM, CISA, or CCSP.
• Contributions to industry standards bodies, ISACs, or open security communities.

About Hashgraph

Hashgraph is a software company supporting and servicing Hedera, an open source, proof-of-stake platform that is EVM-compatible and built for enterprise and web3 applications requiring speed, security, stability, and sustainability. Hedera's public network is governed by industry-leading organizations spanning 11 sectors and 14 regions.