About the Role
Own security across Foundation operations, protocol development and the broader Compound ecosystem. The Head of Security is Compound's security lead. You will own the Foundation's security program across protocol development, infrastructure, access, and partners.
Compound Foundation supports the development, adoption, and responsible growth of Compound - one of DeFi's original lending protocols with over $57B in loans processed - and related decentralized finance tools. We're now focused on Compound's next chapter: building Compound V4, the universal credit layer.
Responsibilities
•Own the Foundation security program across protocol, infrastructure, applications, internal tools, vendors and access controls.
•Own the security sign-off for launches and protocol upgrades: threat models, audit and formal verification scope, bug bounty design, monitoring coverage at launch, and secure SDLC in partnership with the engineering team.
•Direct the DAO's security service providers: allocate the annual audit and formal verification capacity, decide which governance proposals escalate to full audit review, and hold each security provider to scope and high bar for quality.
•Implement incident response procedures for vulnerabilities, exploits, access compromise, vendor compromise and operational security events.
•Harden identity, access management, secrets, GitHub, cloud, CI/CD, endpoint and offboarding practices.
•Support wallet, multi-sig, key management and custody security standards in partnership with Finance/Treasury and Risk.
•Produce short, decision-ready security updates for leadership; escalate material issues or launch blockers quickly.
Requirements
•8+ years security experience, including hands-on security engineering, application security or infrastructure security, with demonstrated end-to-end ownership of a security function — whether as a formal security lead or through growing into program ownership from a technical role.
•Direct DeFi or protocol security experience, including working knowledge of how lending protocols fail: oracle manipulation, liquidation and bad-debt cascades, governance attacks.
•Able to read Solidity and challenge audit and formal verification findings when appropriate.
•Strong understanding of smart contract audits, vulnerability management, bug bounties and secure deployment practices.
•Experience hardening cloud, GitHub, CI/CD, identity, access, secrets management and endpoint environments.
•Experience leading the response to a high-severity security incident, ideally an onchain exploit or emergency.
•Ability to operate as both security strategist and hands-on builder in a small team.
•High urgency and precision when dealing with security risk.
•Strong judgment on security materiality, launch readiness and when to stop or slow execution.
•Ability to communicate security trade-offs clearly to technical and non-technical leaders.
•High autonomy and high standards: able to make sound decisions quickly, own outcomes and communicate clearly when escalation is required.
•Precise written communication: clear asks, owners, deadlines, context, risks and recommendations.
•Strong judgment in ambiguous, fast-moving environments; knows when to move fast and when to slow down.
•Uses AI, automation and better tools to increase quality, pace and leverage; avoids unnecessary manual process.
Nice to have: Traditional finance or other critical financial infrastructure experience is desirable but not required.
Conditions
No conditions stated in the posting.
