Head of Security - Morpho

About Morpho

Morpho is a leading Decentralized Finance (DeFi) lending protocol backed by a16z crypto, Paradigm, Ribbit Capital, and others. We are scaling our team to establish Morpho as the open credit network of the world.

About the Role

As Head of Security, you will define and drive Morpho's security strategy across the entire organization—including corporate IT, cloud, infrastructure, application, supply chain, identity, incident response, and counterparty security. This is a hands-on leadership role where you will build the function from the ground up while staying close to the technical details.

Responsibilities

• Strategy & Governance: Own and evolve the security roadmap and framework, ensuring a coherent approach to tooling and controls.
• Team Building: Hire and develop a high-performing security team.
• Hands-on Execution: Personally execute critical tasks including threat modeling, architecture reviews, and incident command.
• Incident Response: Own end-to-end incident response, including runbooks and market communication.
• Counterparty Security: Build and run a program for curators and partners, including identity verification and operational diligence.
• Compliance: Lead certification strategies (e.g., SOC 2, ISO 27001).
• Cross-functional Leadership: Partner with Engineering, Protocol, and Integration teams to drive security outcomes.

Must-have Experience & Skills

• 10+ years in security, with experience building or leading a function in crypto/web3, fintech, or financial services.
• Strong grasp of the crypto/web3 threat model.
• Proven experience building and scaling a security team.
• Deep, hands-on technical expertise across cloud, infrastructure, CI/CD, and application security.
• Exceptional communication skills, capable of representing security to executives and external institutions.
• Humble, collaborative, and action-oriented.

Success Metrics

• 30 Days: Establish a clear picture of the current posture, architecture, and threat model.
• 60 Days: Publish a prioritized security roadmap and define the team build-out plan.
• 90 Days: Demonstrate progress on high-priority gaps, validate incident response capabilities, and establish an operating rhythm with internal teams.