Head of Security

About the role

Hedera Hashgraph is a rapidly growing company that supports the Hedera platform, which is designed for enterprise and web3 applications. The Head of Security will play a critical role in protecting user funds and the platform's infrastructure by developing a comprehensive security strategy.

In this position, you will oversee various aspects of security, including risk management, compliance with regulations, and third-party vendor management. Success will be measured by your ability to effectively protect the platform from crypto-native threats and ensure a secure operational environment.

Who this role suits

• A candidate with over 10 years of experience in information security and at least 5 years in a senior leadership role.
• Someone who has direct experience in security leadership at a centralized or decentralized exchange.
• An individual with a strong understanding of crypto threats and security governance.
• A proactive leader who can build and scale a security function within a fast-growing organization.

From the employer

Responsibilities

• Set the security strategy and own the policy framework and risk management program for the business unit.
• Decide which certifications, attestations, and regulatory frameworks the business needs.
• Align the program with regulatory requirements in the jurisdictions the business operates in.
• Manage third-party and vendor risk.
• Oversee custody, wallet infrastructure, key management, and wallet operations.
• Govern smart contract security through audit requirements, bug bounty programs, and secure release gates.
• Ensure the architecture behind trading, matching, settlement, and withdrawal flows is secure.
• Drive secure SDLC, vulnerability management, and application security practices.
• Own security monitoring and incident response, including crisis playbooks for exploits, key compromise, and market-impacting events.
• Run tabletop exercises, red team engagements, and penetration testing.
• Coordinate with legal, compliance, communications, and executive leadership during incidents.
• Oversee business continuity and disaster recovery planning as it relates to security.
• Lead a small security function that combines direct execution with tooling, partners, and shared services.
• Manage the security budget, tooling strategy, and vendor relationships.
• Partner with engineering, product, legal, and finance to embed security into operations.
• Define how the function should grow, hiring selectively as the business scales.

Requirements

• 10+ years in information security, including 5+ years in senior security leadership.
• Direct security leadership experience at a centralized exchange (CEX), decentralized exchange (DEX), or comparable digital asset trading or custody platform.
• A track record designing and running security governance programs covering policy, risk, audit, and executive reporting.
• Strong understanding of crypto-native threats, including private key compromise, smart contract exploits, oracle and bridge attacks, insider risk, and social engineering.
• Working knowledge of key management and custody models (HSM, MPC, multisig) and blockchain protocol fundamentals.
• Preferred: Regulatory engagement across multiple jurisdictions (US, EU, UAE, APAC).
• Background in smart contract security, DeFi protocol risk, or on-chain monitoring and forensics.
• Experience standing up a security function inside a newer or fast-scaling business unit.
• Familiarity with DevSecOps and application security posture management.
• Relevant certifications such as CISSP, CISM, CISA, or CCSP.