Director, Security Architect

CoinDesk is the most trusted media, events, indices and data company for the global crypto economy. Since 2013, CoinDesk Media has led the story of the future of money and investing, illuminating the transformation in society and culture that comes with it. Our award-winning team of journalists delivers news and unparalleled insights that bring transparency, comprehension and context. CoinDesk Events gathers the global crypto, blockchain and Web3 communities at annual events such as Consensus, the world’s largest and longest-running crypto festival. CoinDesk Indices offers expertise in digital asset indices, data and research to educate and empower investors. For more information on CoinDesk media and events, please visit http://coindesk.com [coindesk.com] and for breaking headlines, data and indices visit http://coindeskmarkets.com [coindeskmarkets.com]

In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. For more information on Bullish, please visit https://bullish.com . CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence.

Reports to:

CISO Americas

At Bullish, security is not a checkpoint, it is the foundation of trust that lets people move billions across our markets with confidence. The Bullish Security Architecture team secures Bullish Global, including the Bullish Exchange, Bullish Liquidity Services, CoinDesk Indices, CoinDesk Data, CoinDesk Media, and CoinDesk Events, designing the defenses that keep our mission-critical trading systems and other business lines resilient against the most capable adversaries in the world.

As a senior member on this team, you will sit at the intersection of cutting-edge engineering and high-stakes finance, shaping how secure software is built across web, API, mobile, and FIX platforms, and pushing our security bar beyond industry-leading. This is a senior technical leadership role, a hands-on application and cloud security architect who leads through influence, deep expertise, and mentorship.

If you thrive on solving complex technical challenges in a fast-moving crypto landscape and building first-of-their-kind systems, this is where you will do the most impactful work of your career.

This position is based in SoHo London and will be required to work full-time onsite.

• Build complex threat models for critical systems and establish industry-leading cybersecurity requirements to turn ambiguity into clear, prioritized defenses.
• Partner closely with Product, Engineering, and Infrastructure teams to design and ship secure software across web, API, mobile, FIX, and trading platforms.
• Lead complex global security initiatives, build custom AI-powered tooling to maximize efficiency and scale the cybersecurity program.
• Assess vulnerability risks, deliver actionable recommendations across all technical levels, and track health metrics and KPIs for executive reporting.
• Drive high-impact projects and adapt to evolving business needs within a dynamic, fast-paced environment.
• Provide technical leadership and mentorship to the cybersecurity and engineering teams.

• 10+ years in cybersecurity, including 5+ years of hands-on coding, alongside deep expertise in threat modeling, code reviews, and offensive security methodologies.
• Solid working knowledge of Linux environments, including command-line proficiency, shell scripting, system hardening, and security configuration.
• Hands-on experience in penetration testing.
• Strong foundation in network protocols (IP, DNS, HTTP, SSL/TLS), cryptography (PKI, encryption at rest/in motion), and public cloud platforms (AWS, Azure, or GCP).
• Proficient in programming languages like C/C++, Java, JS, Python, Go, or Rust
• Deep understanding of common vulnerability frameworks (OWASP Top 10, SANS CWE Top 25).
• Solid grasp of enterprise software development, Agile, CI/CD pipelines, and security tooling (SAST, DAST, OSA, Vulnerability Management, API traceability).
• Excellent ability to convey complex technical risks to non-technical executives and engineers and build strong cross-functional partnerships.
• A strong individual contributor with ability to drive projects independently from conception to completion with minimal oversight.
• A restless drive to secure systems and continuously learn new technologies.
• Current holder of Offensive Security Certified Professional (OSCP) certification.
• Experience securing trading, financial-market, or other regulated, high-stakes systems.
• Additional relevant certifications, such as security architecture certifications (e.g. SABSA, TOGAF), offensive security (e.g. CISSP, OSCE, SANS, CREST, CISM) and cloud security specialty certifications (AWS, Azure, or GCP).