Head of Security

• Define and own a risk-based security strategy for Airtm’s financial platform
• Prioritize security investment by threat and business impact and report posture to executive leadership and the board
• Own detection, response, and recovery for security incidents
• Maintain runbooks, lead incidents and post-incident reviews, and coordinate with forensics, legal, and communications
• Embed security into the SDLC through threat modeling, secure design reviews, SAST, DAST, dependency scanning, and secure coding standards
• Partner with Infrastructure to harden AWS, Kubernetes, networking, and CI/CD pipelines
• Own IAM, least-privilege access, secrets management, and security in Terraform and GitOps workflows
• Build detection and alerting across application, infrastructure, and access logs
• Own security for key management, wallet and custody operations, and blockchain integrations
• Collaborate with Product and Risk teams on account takeover, abuse, and transaction-level controls
• Define guardrails for AI coding tools, AI agents, and LLM pipelines
• Own the security compliance program, audits, and customer and partner security questionnaires
• Run vendor risk assessments and security due diligence
• Establish vulnerability remediation SLAs and keep remediation moving across teams
• Hire, grow, and lead security engineers and build a security champions network
• Participate in and help shape the security escalation path for production incidents

• 8+ years of experience in information or application security, including 3+ years leading security teams or functions
• Demonstrated experience leading incident response for real, high-stakes incidents, including coordination with external forensics and counsel
• Strong knowledge of AWS security and Kubernetes security, including IAM, network segmentation, RBAC, secrets management, container and image security
• Hands-on experience with application security in a microservices environment: threat modeling, secure code review, and dependency and supply-chain risk
• Experience building detection and monitoring capabilities, including SIEM, log analysis, alerting, and Datadog or similar
• Experience owning or leading a compliance program such as SOC 2, ISO 27001, or PCI-DSS, including audit cycles
• Ability to read and review TypeScript/Node.js code and infrastructure-as-code using Terraform
• Experience securing CI/CD pipelines and software supply chains
• Hands-on experience with AI-assisted tools such as Claude Code, Cursor, or GitHub Copilot for security work
• Clear point of view on risks of AI-generated code and agentic systems
• Strong communication skills for explaining risk to engineers, executives, regulators, and customers and writing policies and runbooks
• Sound judgment under pressure and ability to make fast, defensible calls with incomplete information