Head of Security Assurance

Index Industries is a growing startup, and our security and audit posture needs to grow with it. We already run on solid foundations: AWS, Railway, Ethereum and Datadog cover our infrastructure, hosting, blockchain and observability, and we have built real controls into how we operate custody and the protocol. We have policies, structures, and controls in place. As we onboard more institutional investors and expand toward retail with additional financial products, those foundations need to mature from good defaults into practices built for our domain: investors who run their own diligence, auditors who expect evidence rather than assurances, and venues that gate access to demonstrated controls.

This role is about that maturation, not a rebuild. You will take our detection and response, custody operations and platform security stance from solid basics to the best practices our growth demands across web2 and web3 - and produce the technical evidence that lets investors, auditors and counterparties trust it.

What you'll own

• The assurance program, end to end. SOC 2 is the anchor, and the certifications that follow it: scoping, auditor selection, remediation planning, evidence, fieldwork, report.
• Our external security story. The public trust surface, published audit and attestation material, and a vulnerability disclosure policy researchers can actually use.
• Diligence. You will personally front security questionnaires and the calls behind them, with institutional counterparties and their security teams. You'll be responsible for understanding and representing the security stack, from policies to implementation across web2 and web3.
• The control program. Policies, risk register, vendor reviews, access reviews, key-management ceremonies, tabletop exercises - you run the cadence and you keep the evidence. The operational surface that carries most of our real risk: **multisig ops, treasury ops, incident response, DevOps and infrastru