Chief Information Security Officer

Location & Contract Setup: This is a fully remote, globally distributed independent contractor role — one of the most nomad-friendly structures possible. As a contractor, you're responsible for your own taxes and compliance, which actually gives you more flexibility to operate from virtually any country without an employer needing to establish local payroll.

Timezone & Schedule Flexibility: The role requires leading a small team across many time zones, briefing leadership monthly, and being available to run live incident response. This means you need reliable, fast internet at all times and must be reachable during crises — not strictly async. Expect some fixed overlap hours with the leadership team, likely aligned to US or European business hours.

Nomad Destination Fit: Without a stated salary, cost-of-living comparisons are approximate, but CISO-level contractor rates typically range $150K–$350K+ USD annually. At those rates:

• Lisbon, Portugal — High quality of life, D8 Digital Nomad Visa available, ~$3,000–$4,500/mo living costs.
• Medellín, Colombia — Very affordable (~$1,800–$2,800/mo), fast fiber internet, growing tech scene.
• Chiang Mai, Thailand — Budget-friendly (~$1,200–$2,000/mo), but check timezone overlap needs carefully (UTC+7).

Travel Perks: Team offsites in locations like Dubai and Costa Rica are a standout perk — expect 1-2 paid company gatherings per year, which doubles as built-in travel experiences. No coworking stipend is mentioned explicitly.

Catalyst Capital is a profitable, bootstrapped holding company building a diversified financial services group: education, publishing, software, wealth and tax planning tools, investment products and proprietary trading technology. Funded entirely from its own operating cash — we have never taken outside capital.

The cash engine is Decentralized Masters
, a DeFi education business that went from zero to 150+ people, 4,500+ paying members and roughly $48.6M of FY26 revenue at ~25% earnings before tax in four years. That engine funds everything else.

Catalyst Capital is hiring its first Chief Information Security Officer to own security across every brand in the group. You will set the strategy, build the program, and personally run the response when something goes wrong.

The job is two halves. Half is core CISO work: incident response, identity and access, vendor risk, phishing defense, policy and audit readiness, and the judgment calls only a person can own. The other half is making security AI-driven: mapping our full attack surface and building agentic systems that test, monitor and audit it with near-total coverage, so security keeps pace as more of the company runs on AI.

This is a player-coach role — about half hands-on — leading a small team of engineers. You report to Group leadership, brief the leadership team monthly, and are the person they trust to explain risk in plain language and make the call under pressure.

• Security strategy and program. Own the security strategy, roadmap and budget across Decentralized Masters, Legacy, Inflection Club, Sentinel is and future brands. Report posture, top risks and trends to leadership every month, with a risk register leadership can act on.
• Incident response. Own IR end to end: detection, triage, containment, eradication, recovery and the postmortem. Lead the room during a live incident and coordinate with legal counsel, forensics firms, insurers and regulators. Keep runbooks current and run tabletop exercises.
• Cloud and identity security. Own identity and access across the group: SSO, MFA, least-privilege roles, admin redundancy and short-lived credentials.…