Jobs Chief Security Officer (CSO)

Metamindz is a UK-based technical consultancy - CTO-led software development, fractional CTO services, and technical recruitment for startups and scaleups across the UK, US, and Middle East. Every project is run by real developers and CTOs rather than non-technical account managers, so engineers here work directly on real products and real technical problems.

We're looking for a Chief Information Security Officer (CISO) to own and lead our client's global information security strategy, organization, and execution. The CISO will report directly to the CTO and work closely with Engineering, Platform, SRE, IT, Product, Data, AI, Legal, Privacy and the wider executive team.

This is a highly technical and hands-on security leadership role. It's not primarily about policies, audits, or certifications. We're looking for someone who can understand how systems actually work, identify the risks that matter, and build the technology, processes, teams and culture needed to manage those risks while allowing the company to move quickly.

Who we're looking for:

• 10+ years of experience in security roles, ideally within global software product companies
• 5+ years of significant security leadership experience in a technology, SaaS, marketplace, fintech, HR-tech or similarly data-intensive environment
• 2+ years of experience as a CISO or VP of Security in a global software technology company
• Strong technical security background with the ability to go deep into architecture, infrastructure, identity, applications, cloud and security incidents when required
• Experience leading security across both product technology and corporate IT environments
• Strong cloud security experience, particularly with AWS and/or GCP
• Strong understanding of IAM, SSO, MFA, privileged access, device trust and Zero Trust principles
• Deep product and application security experience, including threat modelling, secure SDLC, vulnerability management, security testing and supply-chain security
• Experience building or operating mature security operations and incident response capabilities
• Experience protecting environments containing significant volumes of personal or otherwise sensitive data
• Strong understanding of SaaS, third-party and supply-chain security risks
• Experience with ISO 27001, SOC 2, GDPR and enterprise customer security requirements
• Familiarity with AI security and emerging risks around LLM-based applications and AI agents
• Strong communication skills and the ability to translate technical security risks into clear business context
• Pragmatic and risk-driven approach - security should enable the business rather than become an unnecessary blocker
• Strong leadership and organizational skills, with the ability to decide what should be built internally, automated, or outsourced

What you'll work on:

• Owning global information security strategy, roadmap and security organization
• Defining measurable security objectives, KPIs, KRIs and risk-acceptance processes
• Building security into the software development lifecycle alongside Engineering rather than creating external approval gates
• Leading product and application security across threat modelling, architecture reviews, secure coding, SAST/DAST, dependency and supply-chain security, secrets management, vulnerability management, penetration testing and bug bounty programs
• Owning the security architecture of cloud infrastructure, including the ongoing migration from AWS to GCP
• Working across IAM, privileged access, network security, containers, infrastructure-as-code, encryption, logging, detection, data security and cloud security posture management
• Building and improving security operations, detection engineering, SIEM, incident response, investigations and security incident playbooks
• Leading security across the corporate technology environment, including identity, SSO/MFA, endpoint security, SaaS and device trust
• Moving the organization towards a practical Zero Trust model
• Building a scalable third-party and supply-chain security program based on actual exposure and business impact
• Establishing security controls for AI-powered products and internal AI usage, including LLM access, AI agents, prompt injection, data exfiltration, model/provider risk, logging and shadow AI
• Working with Legal and Privacy on GDPR, EU AI Act and other regulatory requirements while maintaining ownership of the underlying technical security controls
• Maintaining and evolving security programs such as ISO 27001 and SOC 2 Type II
• Providing the CTO and executive team with a clear and measurable view of the company's security posture and material risks
•  

Nice to have:

• Experience in HR-tech, workforce technology, marketplace, fintech or another data-intensive technology environment
• Experience leading a major cloud migration or transformation, particularly AWS to GCP

What we offer:

• A global CISO role with direct reporting to the CTO and significant ownership of the company's security strategy
• The opportunity to shape security across product, engineering, cloud infrastructure, corporate IT, data and AI
• A genuinely technical leadership position where you can engage directly with architecture, engineering and security problems
• The opportunity to lead security during a major cloud transformation from AWS to GCP
• The chance to build and scale a security organization rather than simply maintain an established security program

We are looking for a forward-thinking, driven, and hands-on Global Chief Information Security Officer (CISO) to design, implement, and scale our global information security strategy. As we expand, you will be responsible for building security processes from scratch, ensuring unimpeachable information security compliance across the regulated markets, and leading a distributed remote team.

This is a leadership role that is focused entirely on the global information security posture of the company.

Key Responsibilities:

InfoSecurity Strategy & Governance:

• Define, drive, and execute the global information security roadmap aligned with business goals.
• Assess and define CEX.IO’s current and future requirements in terms of information security.
• Identify capability gaps in the context of regulatory considerations and industry benchmarks
   

Process Management:

• Build, implement, and optimize robust security processes, frameworks, and policies across the entire organization from the ground up.
• Ensure all target teams are provided with the training and resources needed to perform their jobs to the highest degree possible

Compliance, Certifications & Audits:

• Oversee the successful acquisition and maintenance of industry-specific licenses and certifications (e.g., SOC 2, PCI-DSS, DORA, MiCA/crypto regulations). Manage regular internal/external security audits and executive reporting. 
  To achieve this, you will closely collaborate with:
• External auditors and regulators, acting as the primary technical point of contact and subject matter expert during corporate certification processes and regulatory reviews.
• Legal and data protection team to ensure information security policies strictly map to European GDPR compliance, data privacy laws, and corporate governance standards.
• Managing Directors and Officers within the UK, US, and ES locations to bridge global information security frameworks with local regulatory mandates and licensing requirements.
• Engineering and Product teams to embed security directly into the software development lifecycle and product roadmap. You will collaborate on secure coding practices, vulnerability management, and ensuring that product architectures (especially crypto/wallet features) are secure by design before release.

Team Leadership: 

• Lead, mentor, and scale a high-performing, fully remote security team.
• Foster a culture of accountability and proactiveness.
• Lead all managerial functions in accordance with the company’s policies and procedures (hiring, training, setting goals, appraising performance, budgeting)

Risk & Incident Management:

• Act as the ultimate point of escalation for global security incidents, ensuring proactive threat hunting and rapid mitigation.
• Manage the oversight of technical risk assessments, such as vulnerability scanning, penetration testing, risk reviews for new applications, and third-party risk assessments

Requirements (Must-Haves)

• Experience: Proven track record in a senior security leadership role (CISO, Director of Security, or Head of Information Security) within the Financial Services or FinTech sector.
• Direct experience steering organizations through complex information security audits, certifications, licensing, and international regulatory compliance.
• Demonstrated experience in creating, implementing, and managing group-level security processes and frameworks.
• Exceptional leadership skills with a proven ability to manage remote, distributed teams. Strong sense of ownership, proactiveness, and high responsibility.
• Language: Fluent English with excellent communication and reporting skills; Ukrainian or Russian will be an advantage.
• Location: Must be physically located and legally authorized to work remotely within Europe.
   

Preferred (Nice-to-Haves)

• Hands-on experience in the Cryptocurrency, Web3, or Blockchain industry,understanding specific security vectors (custody, cold/hot wallet security).

Про проєкт

Шукаємо Security Officer (CISO) для побудови та підтримки системи інформаційної безпеки компанії: захист IT-інфраструктури, мобільних пристроїв, комунікацій та критично важливих даних (торгові стратегії, API-ключі, ринкові дані). Роль охоплює як класичну IT security, так і специфічні для арбітражної/трейдингової діяльності ризики: захист інтелектуальної власності, insider-загрози, безпечне зберігання ключів доступу до бірж.

Обов'язки

• Аудит IT-інфраструктури, виявлення вразливостей, впровадження систем захисту (firewall, antivirus, IDS/IPS);
• Управління доступом співробітників до даних та акаунтів за принципом мінімальних привілеїв;
• Моніторинг мережевого трафіку, виявлення підозрілої активності;
• Розробка та впровадження політик безпеки і внутрішніх регламентів;
• Впровадження та адміністрування MDM: шифрування, блокування екрану, 2FA, remote wipe, контроль встановлених застосунків;
• Розгортання EDR-агентів на всіх ПК, реагування на інциденти в реальному часі;
• Захист телефонних систем та каналів зв'язку від перехоплення, впровадження шифрування голосових даних;
• Захист торгових стратегій, API-ключів та ринкових фідів; безпечне зберігання і ротація ключів (vault, HSM);
• Моніторинг insider-загроз, запобігання витоку IP (NDA, класифікація даних, DLP);
• Централізоване управління паролями та апаратними ключами команди; офбординг з негайним відкликанням доступу;
• Розслідування інцидентів та реагування на кібератаки; ведення playbook'ів реагування;
• Backup та disaster recovery за правилом 3-2-1 з регулярним тестуванням відновлення;
• Проведення внутрішніх пентестів, організація red team та phishing-симуляцій;
• Централізоване логування/SIEM, алертинг на аномальну активність;
• Навчання співробітників кібергігієні; підготовка звітів та аналітики;
• Підготовка та підтримка завантажувального USB з портативною ОС (Kali, Tails, Parrot) для sales-команди: демонстрація можливостей безпеки клієнтам, аудит мереж на місці.

Вимоги (must-have)

• Досвід 2-3+ роки в кібербезпеці / IT security;
• Впевнене знання мережевої безпеки: TCP/IP, DNS, HTTP, SMTP, налаштування firewall, IDS/IPS;
• Адміністрування Windows та Linux, управління обліковими записами та правами доступу;
• Досвід з MDM та політиками безпеки мобільних пристроїв;
• Розуміння криптографії: шифрування, цифрові сертифікати;
• Досвід security-аудиту: сканування вразливостей, penetration testing;
• Розуміння VoIP/IP-телефонії та захисту каналів зв'язку;
• Досвід збірки та підтримки завантажувальних Linux-дистрибутивів (Kali, Tails, Parrot), мультибут (YUMI, Rufus), сумісність з UEFI/Legacy BIOS;
• Аналітичне мислення, стресостійкість, комунікабельність, здатність працювати під тиском.

Буде плюсом

• Сертифікації: CompTIA Security+, CISSP, CEH;
• Розуміння стандартів ISO 27001, GDPR;
• Досвід з DLP-рішеннями (Symantec DLP, Microsoft Purview);
• Досвід з vaulting/secret management (HashiCorp Vault, AWS Secrets Manager);
• Досвід з EDR/SOC інструментами (CrowdStrike, SentinelOne, Wazuh);
• Знайомство з Zero Trust архітектурою;
• Досвід протидії фішингу та соціальній інженерії.

Що пропонуємо

• Повна зайнятість (full-time);
• Умови за домовленістю.