Head of Cybersecurity

About RedStone

RedStone is a blockchain company building the next generation of oracle infrastructure, delivering reliable, secure and low-latency data to blockchain applications. Today, our infrastructure powers 160+ protocols across DeFi, tokenized real-world assets (RWAs) and institutional blockchain applications, securing over $6.7B in Total Value Locked (TVL). Our products include modular Price Oracles, Proof of Reserve, Atom (OEV), Bolt (sub-second push) and RedStone Settle, designed for both decentralized and institutional use cases. RedStone is ISO/IEC 27001:2022 certified (SGS, UKAS-accredited) and has been audited 15+ times by Halborn, ABDK, PeckShield, Cantina and others. We are the official oracle partner of Securitize and work with institutions bringing BlackRock, Apollo, Hamilton Lane and Invesco products on-chain. Those clients treat our feeds as critical financial infrastructure, and this role exists to protect them to that standard.

The Role

You will lead cybersecurity at RedStone: protecting the AWS and cloud infrastructure that runs our data delivery services, detecting and responding to threats against it, testing it the way an attacker would, and rolling out operational-security standards that every team in the company actually follows.

You are a hands-on leader, not a policy author: you design the controls, build the detections, run the pentests yourself, and then bring the rest of the company along. This is a solo, senior role reporting to the CTO. You will work in cooperation with our CSO and in close partnership with the Head of QA and Technical Operations and the Head of Infrastructure, who own the systems and processes you protect.

What you will own

• AWS and cloud security - account structure and guardrails (Organizations, SCPs), IAM and least privilege, network segmentation, KMS and Secrets Manager, CloudTrail and VPC Flow Logs, WAF; the same standard across our SaaS estate, built together with the Head of Infrastructure
• Threat detection and response - the SIEM and detection pipeline; detections for what matters most to a blockchain oracle (unexpected signing activity, privilege changes, pipeline tampering, anomalous feed behaviour); alerting and on-call escalation; incident-response playbooks, tabletop exercises and post-mortems
• Penetration testing and offensive security - a standing programme of internal pentests and red-team exercises against our AWS accounts, APIs, RPC endpoints, relayers and CI/CD; scoping and managing external pentests and audits; triaging Cantina bug-bounty findings and driving fixes
• Critical-infrastructure resilience - controls for systems where downtime or compromise has a direct financial cost: change control for production and smart-contract deployments, dual control for sensitive operations, break-glass procedures, availability and latency SLOs, DDoS posture; run jointly with the Head of QA and Technical Operations
• Company-wide OpSec standards - define and roll out operational-security standards across every team, not only engineering: device and endpoint baselines, identity and account hygiene, hardware-signer handling, travel and social-engineering protocols, phishing resilience, security onboarding and training; measure adoption and close the gaps
• Blockchain infrastructure security - protecting the oracle nodes, on-chain relayers, RPC endpoints and push infrastructure that deliver our feeds across 70+ chains; signer and deployer keys (HSM, KMS), key ceremonies and rotation; multisig and admin-key controls for smart-contract deployments and upgrades; monitoring for anomalous on-chain activity against our contracts and feeds
• AI in security operations - evaluate and adopt AI tooling for detection, triage and investigation where it beats rules alone, and secure our own use of AI tools and agents
• Secure software delivery - branch protection, code-review gates, signed artifacts, dependency and secrets scanning in GitHub Actions, built with the Head of Infrastructure and the engineering leads

Requirements

• 5+ years in cybersecurity, including 3+ years leading security for production-critical systems
• Strong, hands-on knowledge of AWS security and cloud-service protection: IAM, Organizations and SCPs, VPC design, KMS, CloudTrail, WAF; securing containers (EKS/ECS) and serverless workloads
• Experience securing and operating critical financial infrastructure - a bank, exchange, payments, trading, custody or market-data system - where availability and integrity carry a direct financial cost
• Deep understanding of threat detection: building detections, running a SIEM or XDR platform, threat hunting and leading incident response
• Hands-on penetration-testing experience and fluency with standard pentest and cloud-security tooling; you can show what you would break and how
• A track record of designing and rolling out OpSec standards across a whole company - and getting non-engineers to follow them
• Comfortable writing Terraform, TypeScript scripts and GitHub Actions workflows to build controls yourself; you ship fixes, not tickets

Nice to have

• Blockchain infrastructure experience: running oracle or validator nodes, relayers and RPC infrastructure; signing keys on HSMs, KMS, MPC or hardware signers; multisig and admin-key setups; smart-contract security and DeFi threat models
• Hands-on experience with state-of-the-art AI tooling for threat detection and security operations - AI-assisted alert triage and investigation, anomaly detection, LLM-based agents for SecOps - and a clear view of where they help and where they don't

What we offer

• Competitive B2B compensation: 30,000-40,000 PLN/month + VAT
• Token allocation after 3 months of cooperation
• Fully remote work, with the option to work from our office in the center of Warsaw
• Private healthcare and Multisport card
• Budget for certifications, conferences and security training
• Company equipment and a hardware budget for the role
• Company offsites and team events

Get to know us

• Website: https://redstone.finance
• Docs: https://docs.redstone.finance
• Security: https://www.redstone.finance/security
• GitHub: https://github.com/redstone-finance
• LinkedIn: https://www.linkedin.com/company/redstone-oracles
• Blog: https://blog.redstone.finance

Recruitment Process

• Introductory call with HR
• Technical interview - cloud and detection: walk through a representative AWS setup, show how you would attack it, and design the detection that would have caught you
• Technical interview - leadership case: rolling out an OpSec standard across a 50-person remote company, plus blockchain-infrastructure and incident-response scenarios
• Final interview with the founders.