Chief Information Security Officer (CISO)

About this role

As CISO, you will own the Foundation’s security strategy and program, reporting to the CTO. You will lead the implementation of security framework across the Foundation, using it to assess gaps, set priorities and verify that controls are operational. You will propose budgets and resource plans, advise leadership on material security risks, lead security incident response, and oversee protocol assurance with engineering. You will also represent the Foundation in security discussions with institutional counterparties. As the security leader within a small team, you will have direct ownership of the Foundation’s security program and substantial influence over how it is built and run.

What you’ll do

• Own the Foundation’s security strategy and program across protocol, infrastructure, applications, internal tools, vendors and access controls. Set priorities, propose budgets and resource plans, and track implementation and control effectiveness.

• Build and run a security risk-management program using recognized and proven frameworks. Maintain a risk register, prioritised treatment plans and evidence that controls work. Present investment priorities, residual risks and exceptions to leadership, with clear recommendations and accountable owners.

• Lead security engagement with institutional counterparties and their CISOs, including security due diligence, control evidence and discussions of residual risk.

• Own the security assessment and recommendation for launches and protocol upgrades, covering threat models, audit and formal verification scope, remediation evidence, bug bounty design, monitoring coverage at launch and incident readiness. Maintain a secure SDLC in partnership with engineering. Escalate unresolved material findings and launch blockers to the authorised decision-makers.

• Coordinate DAO-funded audit, formal verification, monitoring and incident-response providers within their approved mandates. Recommend priorities for annual audit and verification capacity and identify governance proposals requiring additional security review. Track delivery against agreed scope and quality standards, and escalate gaps to the relevant decision-makers.

• Lead security incident response across Foundation teams and coordinate with security providers and authorised governance participants or signers. Establish and exercise response procedures for vulnerabilities, exploits, access compromise, vendor compromise and operational security events. Confirm who can authorise and execute containment actions, oversee recovery checks, and track corrective actions to completion.

• Harden identity, access management, secrets, GitHub, cloud, CI/CD, endpoint and offboarding practices.

• Support wallet, multi-sig, key management and custody security standards in partnership with Finance/Treasury and Risk.

• Produce short, decision-ready security updates for leadership; escalate material issues or launch blockers quickly.

Requirements

• 8+ years security experience, including hands-on security engineering, application security or infrastructure security, with demonstrated CISO-level accountability for a security function: strategy, security risk management, resource prioritisation and executive reporting. A previous CISO title is not required.

• Experience implementing NIST CSF 2.0 or an equivalent security framework and using it to set security priorities and verify improvements in controls.

• Direct security ownership of live on-chain systems or assets, including accountability for security decisions affecting user funds or protocol control. Working knowledge of DeFi lending failure modes, including oracle manipulation, liquidation and bad-debt cascades, and governance attacks. This on-chain security experience may come from a different role than the candidate’s CISO-level accountability.

• Ability to challenge security findings, audit and formal verification coverage, and remediation evidence; direct qualified technical specialists; and form defensible security recommendations.

• Strong understanding of smart contract audits, vulnerability management, bug bounties and secure deployment practices.

• Experience hardening cloud, GitHub, CI/CD, identity, access, secrets management and endpoint environments.

• Experience leading the response to a high-severity security incident, ideally an onchain exploit or emergency.

• Ability to set security strategy and take direct responsibility for implementing controls and establishing assurance in a small team, working with engineers and specialist security providers.

Preferred Experience

• Ability to read Solidity and experience reviewing smart contracts.

• Experience in traditional finance or other critical financial infrastructure.

• Experience leading institutional security due diligence and assurance.

Qualifications

• Act with urgency and precision on material security risks, making independent recommendations on launch readiness and when to stop, slow or escalate work.

• Challenge assumptions and security decisions constructively, take ownership of outcomes, and exercise sound judgment under uncertainty.

• Communicate security trade-offs clearly to technical and non-technical leaders. Write concise recommendations with the relevant context, risks, decisions needed, owners and deadlines.

• Use AI and automation to improve security work, with controls for sensitive information and verification of security conclusions.

About Compound

Compound Foundation supports the development, adoption, and responsible growth of Compound - one of DeFi's original lending protocols with over $57B in loans processed - and related decentralized finance tools. We’re now focused on Compound’s next chapter: building Compound V4, the universal credit layer.