Actual compensation is unique to each candidate and based on a variety of factors such as skill set, experience, and specific work location. Salary is one part of Bastion’s total compensation and benefits package.

We are proud to present to all employees a generous equity offering and additional benefits including:

• Flexible work schedules

• Unlimited paid vacation & holidays

• Several holistic and balanced life benefits such as: comprehensive health coverage, life insurance, retirement benefits, paid parental leave, tax-advantaged accounts, One Medical, Spring health, and more.

About Bastion

Bastion enables financial institutions and enterprises to issue regulated stablecoins, generate revenue on reserves, and expand their ecosystems. Bastion’s platform combines stablecoin issuance, secure custody, and seamless orchestration for cross-border transfers, on/off-ramps, and stablecoin conversions. With Bastion’s platform and APIs, businesses can create and scale their stablecoin network, while optimizing revenue, compliance, and control.

You can check out our Guide for Candidates here to learn more about our work.

Overview

We are looking for a player-coach Head of Security to build and lead our security engineering function at a critical growth stage. In this role, you’ll be hands-on with our security infrastructure while establishing the strategic foundation for our security program. You'll work closely with our compliance and risk teams to ensure our stablecoin platform meets the highest security standards, balancing technical excellence with the regulatory rigor our industry demands.

This is an opportunity to shape security culture at a 32-person company, where your decisions will directly impact our ability to scale safely and maintain the trust of our users and partners. You will inherit a strong foundation (see this AWS case study that includes us) and be able to add at least 1 security engineer to your team in Q1 2026.

It is highly likely that you have setup a security program before - knowing how to prioritize your work and setting high standards. Given our industry, it is highly preferred that you have experience working with regulatory and compliance teams, as well as experience with product security and detection and response.

This role balances hands-on security engineering (implementing controls, building detection capabilities) with establishing and enhancing governance frameworks and working closely with compliance teams. You'll need to be comfortable both writing code and writing policies that satisfy auditors.

We are open to this role being based remotely in the United States, though there is an advantage to being based (or willing to relocate) to NYC.

Work to Be Done

Instead of a list of requirements, we want to give you a directional look into the first 7/15/30/90 Days.

If you think this is something you can handle, we will be excited to speak with you.

7 days — Rapid orientation and decision velocity

• Meet key stakeholders to understand business goals and risk appetite

• Review current security posture, tooling, processes, and identified risks

• Confirm incident response coverage and escalation paths

• Deliver an initial readout with near-term priorities

By day 15 - Unblock and set the operating rhythm

• Define Bastion’s security north star and success metrics in alignment with leadership

• Establish an operating cadence (standups, intake, prioritization, communication loops)

• Kick off 1-2 high‑impact risk‑reduction efforts

• Identify key compliance and policy gaps

By day 30 - Ship visible progress and reduce risk

• Partner with Platform and App teams to implement baseline engineering guardrails

• Validate core detection and response workflows through a tabletop exercise

• Publish a simple dashboard for key security KPIs

• Launch lightweight enablement for engineers and security champions

• Begin interviewing candidates for your future team

By day 90 - Scale impact and prove durability

• Formalize security policies and governance rhythms with cross‑functional partners

• Ship at least one security improvement that measurably improves developer velocity or reduces friction

• Demonstrate measurable risk reduction against agreed KPIs

• Define the next two quarters of the security roadmap and resourcing plan

• Run a resilience exercise and fold learnings into continuous improvement

If you think this is something you can handle, we will be excited to speak with you.

Bastion provides equal employment opportunities to all employees and applicants for employment and prohibits discrimination and harassment of any type without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws. This policy applies to all terms and conditions of employment, including recruiting, hiring, and placement. Bastion participates in E-Verify to authorize eligibility of employment in the United States.

Compensation Range: $240K - $300K