Head of Security & IT

The 4 biggest blockchain strengths are also its weakness

Permissionless nature leads to fragmentation of meaning

Decentralization leads to too many standards

Immutability leads to exponential data + query infrastructure complexity

Neutrality means that no one is accountable for interpretations

Blockchain data is public. It is not usable at institutional scale. Despite being open, blockchain data is fragmented, hard to interpret, and painful to maintain. Even a simple question like “Who are the largest Ethereum token holders over time?” can require running nodes, ingesting full chain history, decoding contracts, cleaning edge cases, and writing complex SQL.

Blockchains are optimized for writes, not reads.

They are built for consensus and execution, not searchability, standardization, or financial interpretation. Blockchains are computers, not databases . Every protocol defines its own schema. The same economic action can be encoded in dozens of different ways. The result:

Fragmented standards

Exponential complexity

No accountability for interpretation

Events without economic meaning

Finance cannot operate on that, it needs an effective system of record .

Allium is building the System of Record for Onchain Finance

Allium ingests, verifies, and standardizes data across 140+ blockchains and 30+ petabytes of history. We close four structural gaps that prevent blockchains from becoming systems of record:

Semantic Gap: Translating raw events into financial concepts like payments, trades, deposits, and staking income

Standardization Gap: Mapping thousands of protocols into a single canonical cross chain schema

Infrastructure Gap: Read optimized, globally distributed data at web scale

Accountability Gap: Auditable methodology, SLAs, and SOC 1 and 2 compliance

The result is a neutral, canonical data layer institutions can build on with confidence.

Finance is moving onchain

Stablecoins, tokenized assets, trading, staking, and lending are growing rapidly. Institutions need a trusted source of truth for onchain financial activity, just as they rely on Bloomberg or DTCC in traditional markets. Raw blockchains cannot serve that role.

As AI agents begin transacting autonomously , the requirement becomes even stricter. Agents cannot reason over raw event logs. They need structured data, attribution, condition checks, and auditability.

Allium is the read layer that makes onchain finance usable for humans and machines.

Who We Serve

Allium powers three core personas with the same canonical data foundation:

1. Finance, Accounting, and Risk Teams They need reliable, audit grade answers. They rely on Allium for financial reporting, reconciliation, compliance, risk monitoring, and defensible metrics that can stand up to auditors and regulators.

2. Engineers and Product Teams They need low latency, production ready infrastructure. They use Allium to power wallets, trading systems, payment rails, staking infrastructure, and real time applications that cannot break.

3. Strategy, Research, and Executive Teams They need clarity and insight. They use Allium to understand ecosystem economics, market structure, user behavior, competitive dynamics, and where capital is flowing onchain.

And of course...agents 🦞. Our customers and users include Visa, Stripe, G-SIB Banks, Big 4 Accounting firms, BCG, Coinbase, Phantom, Uniswap and cited by the Federal Reserve.

About the role

We're hiring a hands-on security leader to own Allium's security program and employee IT environment. You'll set priorities, implement controls, and partner with Engineering and business teams to protect the systems and data our company depends on.

AI is changing how software is built and how attackers operate . We want someone who can help Allium use agents and automation safely while building effective defenses against credential theft, compromised dependencies, and fast-moving attacks. You'll combine technical execution with ownership of a growing function, working directly on problems while shaping the team, tools, and specialist support we need.

What you'll do

Own the security roadmap. Assess our environment, prioritize material risks, and turn priorities into implemented controls with clear owners. Give leadership a concise view of progress, unresolved exposure, and decisions that require their judgment.

Set the security approach for AI agents. Establish practical standards for agent identities, tool permissions, credential handling, execution isolation, data access, and logging. Partner with Engineering to evaluate coding assistants, model gateways, and integrations, and test for prompt injection, tool misuse, and unintended actions.

Own employee IT and workforce security. Own the coverage and effectiveness of controls across employee devices, identities, cloud environments, and critical SaaS applications. Track exceptions, assign remediation owners, and build reliable onboarding and offboarding processes. Define how routine IT support is delivered through internal resources or providers.

Strengthen cloud and software security. Reduce standing privilege and strengthen separation between employee devices, development environments, and production. Establish practical standards for credential storage and privileged access. Partner with Engineering on secure development, CI/CD, and software supply-chain controls.

Lead detection, response, and recovery. Build a coordinated program across cloud, identity, development, employee systems, and agent activity. Define responsibilities for internal teams and providers, maintain escalation paths, and test containment, credential-revocation, and recovery procedures with system owners.

Build a fast, evidence-based vulnerability response. Maintain visibility into internet-facing services, including developer tools and management interfaces. Track relevant threats and active exploitation, determine whether we are exposed, and coordinate patching, isolation, credential revocation, or other mitigations. Prioritize based on evidence and business impact.

Support enterprise trust. Coordinate audits, customer security reviews, vendor assessments, and technical evidence. Work with Legal and commercial teams so security commitments reflect actual controls and have clear owners.

Build the function. Select and manage security and IT tools and providers, automate recurring work, and help hire and develop the team as needs grow. Use AI to improve the team's work with appropriate data safeguards and validation.

What we're looking for

Typically 6+ years of relevant security engineering, infrastructure security, or corporate security experience, with evidence of independently owning meaningful security improvements.

Recent hands-on experience implementing controls in cloud-based environments. You can investigate a technical issue yourself and work effectively with the engineers who own production systems.

Depth across several relevant areas, including identity, cloud or application security, detection and response, endpoint security, or software supply-chain security. You know when specialist support is needed.

Experience building or improving a security program at a growing technology company, including making tradeoffs with limited time and resources.

Practical judgment about AI-enabled tools: where they can help, how their access should be controlled, and how to validate their behavior and output.

Clear communication with engineers, business leaders, customers, and providers. You can explain a risk, recommend a proportionate response, and follow through.

Experience that would be helpful

Enterprise SaaS, data infrastructure, fintech, or another business serving customers with rigorous security requirements.

Securing AI agents, developer tooling, CI/CD, or systems that use non-human identities and third-party integrations.

SOC 2, customer assurance, vendor security reviews, or m