M0 Labs - Head of Security and Risk

Location: Remote (hubs in NYC and Berlin)
· Permanent, full-time
· Base salary from $220,000 USD per year plus equity/token grant

M0 is the shared infrastructure where businesses launch their own branded stable coins and financial institutions power them. Built on a common standard, every stablecoin on M0 is interoperable and liquid from day one – giving businesses programmable control over how money moves in their ecosystems, and giving financial institutions the most advanced issuance stack in the industry.

M0 is seeking a sharp, execution-focused Head of Security & Risk to build and own the information security and risk function from the ground up. This is a foundational IC role at a critical inflection point for the company – M0 is onboarding regulated institutional partners, expanding its on-chain liquidity solutions, and operating infrastructure that regulated entities depend on. The information security and risk posture we establish in the next 12 months will define how M0 is perceived by partners, regulators, and institutional investors for years to come.

Reporting to Deputy COO, you will be M0’s first dedicated information security and risk professional – responsible for building the enterprise risk management program, owning the information security compliance certification roadmap, establishing the security operations framework, and responding to partner security due diligence requests. You will work daily across engineering, product, legal, BD, and operations to ensure that M0’s security posture is proactive, documented, and defensible.

• Build and Own Enterprise Risk Management
  :
  Build M1’s enterprise risk program from scratch. Cover security, operational, regulatory, and counter party risk, including the risk register, annual assessments, scenario analyses, and escalation framework across all entities.

• Own the Information Security Compliance Certification Program
  :
  Own M1's compliance posture across SOC 2, ISO 27001, and other applicable frameworks — driving all non-technical work streams (policy writing, auditor coordination, vendor risk, access reviews, third-party SaaS vendor evaluations) and keeping the organization audit-ready at all times.

• Establish the Information Security Operations Framework
  :
  Design and maintain M1's incident response framework, ISMS documentation, and security policies — own external security vendor relationships, facilitate tabletop exercises covering IR, BCP, and DR scenarios, and drive the selection of a security advisory firm for on-call support.

• Own Partner Information Security Due Diligence
  :
  Serve as M1's primary point of contact for institutional partner security due diligence and inbound security questionnaires, build and maintain the reusable documentation package for responding to partner requests, and coordinate with Senior Counsel on information security representations in commercial agreements.

• Build Information Security Awareness & Culture
  :
  Design and own M1's security awareness training program, ensure all employees understand their security obligations, and build a proactive security culture across engineering, operations, legal, and business teams.

• A Proactive Risk Thinker: You think in terms of likelihood, impact, and mitigation, and you reason from first principles when regulations are unclear, translating complex risk into clear, business-relevant language.

• Exceptionally Organized and Process-Driven
  :
  You maintain rigorous documentation, evidence records, and program trackers across concurrent work streams. Your outputs need to be right and audit-ready at all times, and you have a track record of improving processes, not just running them.

• A Builder with High Ownership
  :
  You are a…