<h3>Responsibilities</h3><ul><li>Conduct, design, and implement testing of security controls covering identity management, key management, and infrastructure (network and cloud) configurations.</li><li>Support client assurance activities, including responding to Requests for Proposals (RFPs), Requests for Information (RFIs), and Due Diligence Questionnaires (DDQs).</li><li>Identify and analyze trends in client inquiries and provide feedback to internal teams to improve documentation and control readiness.</li><li>Perform security due diligence and ongoing monitoring for Web3/blockchain vendors, including assessing their control maturity, reviewing SOC reports and security documentation, and identifying residual risks.</li><li>Facilitate external audit activities, including coordination of walkthroughs, evidence collection, and response tracking.</li><li>Identify and analyze gaps in current and new processes, then develop and track remediation recommendations to completion (e.g., onboarding flow).</li><li>Develop and maintain understanding of applicable financial regulatory security requirements and ensure alignment of controls.</li><li>Research and share information security best practices, emerging threats, and mitigation strategies with internal teams.</li><li>Evaluate and propose next-generation security tools, automation, and technologies to enhance overall security posture.</li><li>Review blockchain network or protocol upgrades for their potential security impact on the platform.</li><div><br /></div></ul><h3>Requirements</h3><ul><li>At least 8 years of relevant experience in security assurance, audit, compliance, or cloud security engineering.</li><li>Demonstrated experience testing and validating security controls across IAM, key management, and network/cloud environments.</li><li>Strong understanding of Identity and Access Management (IAM) principles.</li><li>Knowledge of cryptographic key management, HSMs, and KMS systems.</li><li>Solid grasp of cloud and network security architecture and configuration.</li><li>Proven experience supporting SOC 1, SOC 2, ISO 27001, PCI DSS, or similar external audits and assessments.</li><li>Exposure to major cloud platforms (AWS, GCP, Azure) and infrastructure-as-code.</li><li>Experience in preparing client assurance materials, RFP/RFI/DDQ responses, and evidence documentation.</li><li>Familiarity with blockchain platforms or digital asset custody systems is advantageous.</li><li>Can work independently and under pressure.</li><li>Excellent verbal and written communication skills</li><li>Pragmatic and solution-oriented approach, ability to balance security requirements with operational feasibility and business needs.</li><div><br /></div></ul>

Crypto.com

Head of Custody Security

Crypto.com

Similar Remote Jobs