Head of Security Aptos Foundation

Aptos is a people‑first blockchain on a mission to help billions of people achieve universal and fair access to decentralized assets in a safe and scalable way. Founded by some of the original creators and maintainers that researched, designed, and built the Diem blockchain to serve this purpose, we have dedicated several years toward this mission. We believe the open‑source Diem technology we have developed is an important foundation of a safe and scalable web3 world where everyone has more equitable opportunities to grow and access financial assets with lower fees and fewer intermediaries.

Aptos (Ohlone for "The People") encapsulates our mission and ethos for why we build.

We are seeking an experienced and self‑motivated Head of Security (Aptos Foundation) to lead our digital and physical security efforts.

• Services:
  Discord, 1
  
  Password, company hardware including phones and computers.
• Operational deployments of our core infrastructure such as Aptos Community page, Aptos Foundation page, Faucets, Indexer APIs, and other services within cloud infrastructure in AWS and GCP.
• Operational configuration of validators, full nodes and other publicly reusable services that leverage Terraform and Pulumi across various cloud vendors.
• Software:
  Distributed services (consensus, state sync, mempool), networking services (P2P network with Noise, REST APIs, Indexer), storage services, VMs and their interface into the application space, libraries and application smart contracts, command‑line interface tools, SDKs (Rust, Python, Typescript), wallets (browser extension, mobile, custodial).
• Release processes for SDKs, nodes, indexers, operational services, docker containers, and the wallet.

• Audit, define, develop, and maintain an Information and Security Framework across Aptos in line with relevant legislation, regulation, and industry standards applicable.
• Define, build, and maintain the required culture, plans, policies, procedures, systems, controls, reporting mechanisms, and assurance framework.
• Lead training classes for both operational and software development security.
• Continuously review ongoing development processes to engage early in the software development process.
• Define security goals and objectives, and align the wider team to them.

• 7+ years of relevant work experience.
• Deep understanding of Information Security and risk management best practices, including ISO/IEC 27001, NIST CSF, CIS 20 CSC, and COBIT.
• Experience with identity and access management, Security Incident and Event Management (SIEM), Security Operation Center (SOC), remote working, and cloud‑first technologies.
• Strategic and systematic thinking with delivery focus.
• Ability to work within a regulatory framework and articulate its potential as a tool for continuous improvement across the organization.
• Experience conducting penetration tests and/or managing third‑party audit firms.

• 100% insurance premium coverage for medical, dental, and vision for you and your dependents (US Employees).
• Equipment of your choice.
• Flexible vacation time, 11 holidays, and floating company days off.
• Competitive Salary.
• Protocol Token Grants.
• 401k matching (US Employees).
• Fun and inclusive in‑person and digital events.

Aptos is committed to diversity in the workplace, and we’re proud to be an Equal Opportunity Employer. We do not hire on the basis of race, color, religion, creed, gender, national origin, citizenship, age, disability, veteran status, marital status, pregnancy, parental status, sex, gender expression or identity, sexual orientation or any other basis protected by local, state or federal law. All employment is decided based on qualifications, merit and business need.

We are committed to providing a safe and secure hiring process for all applicants. Unfortunately, there are individuals who may attempt to impersonate Aptos or our employees for fraudulent purposes. To protect yourself, please be aware of the following:
We will never ask you for payment of any kind during the application or onboarding process, including fees for background checks, training or equipment. We will always communicate with you using our official company email domain. We will never request your personal financial information, such as your social security number or bank account details, during the initial application stages or via email or a video/voice call when onboarding.