M0 Labs - Head of Security and Risk

Role overview Build and lead the information security and risk function for a financial infrastructure organization serving institutional partners. As the first dedicated security and risk specialist, you will establish practical programs, maintain audit readiness, and work across technical and business teams to make risk controls clear, documented, and defensible.

Responsibilities - Create an enterprise risk management program covering security, operational, regulatory, and counterparty risks, with registers, assessments, scenarios, and escalation paths. - Own certification readiness across SOC 2, ISO 27001, and other relevant frameworks, including policies, evidence, access reviews, vendor assessments, and auditor coordination. - Establish incident response processes, information security management documentation, and security policies. - Manage external security and compliance providers, and organize tabletop exercises for incident response, business continuity, and disaster recovery. - Lead responses to institutional partner security reviews and questionnaires, maintaining reusable supporting documentation. - Develop security awareness training and coordinate security representations in commercial agreements with legal colleagues.

Requirements - Seven to ten years in information security, risk, governance, risk and compliance, or compliance operations, ideally in fintech, crypto infrastructure, or B2B software. - Track record building a certification program from the ground up, including hands-on ownership of a full SOC 2 audit cycle and ISO 27001 implementation or maintenance. - Experience with GRC automation platforms, cloud security environments, and business continuity and disaster recovery program design. - Proven ability to manage auditors, penetration testing firms, and compliance vendors through evidence collection and reporting. - Working knowledge of AWS, GCP, and Azure, including security controls in DevOps and infrastructure deployments. - Strong documentation, organization, communication, and cross-functional influence; able to turn complex risk into clear business guidance.

Nice to have Security certifications such as CISSP, CISM, CRISC, Cloud+, or CySA+; familiarity with digital assets, stablecoins, smart contract risk, on-chain monitoring, or emerging financial regulations; and experience with multi-entity organizations.

Benefits and work setup Remote work is available, with hubs in New York and Berlin. The package includes health coverage, a wellness allowance, gym membership, equipment support, and an annual professional development budget. The listing also states a base salary from USD 220,000 per year plus an equity or token grant.