Director of Cybersecurity & Incident Response

About the role

COINS.XYZ Digital Markets, the Brazilian arm of the COINS.PH group, is building a regulated virtual‑asset service provider under Brazil’s new crypto‑asset framework. We are looking for a Statutory Director of Cybersecurity & Incident Response who will be registered with the Central Bank of Brazil and hold personal regulatory responsibility for the security of our crypto‑exchange and custody platform.

Key responsibilities

• Design, implement and maintain the Cybersecurity Policy, Incident Response Plan and Cloud Services Contracting Policy in line with BCB Resolutions 85/2021 and 520/2025.
• Oversee protection of private keys and custody architecture, including cold/hot/warm wallets, MPC, multisig and HSM solutions.
• Lead the security operations centre (SOC/SIEM), threat‑intelligence, vulnerability management, penetration testing and red‑team activities.
• Report security incidents to the Central Bank, ANPD (LGPD) and other authorities and coordinate post‑incident remediation.
• Manage third‑party and cloud risk through vendor due‑diligence, contractual safeguards and BCB notification procedures.
• Integrate cybersecurity into the broader risk framework together with Risk, Compliance, AML and IT functions.
• Build and lead a dedicated cybersecurity team and promote a security‑by‑design culture.
• Represent the company before regulators, auditors and the Board on all cybersecurity matters.

Required profile

• Brazilian residency with an unblemished reputation as defined by BCB Resolution 519/2025.
• Willingness to undergo Central Bank authorisation and ongoing supervisory scrutiny.
• Bachelor’s degree in Computer Science, Information Security, Engineering or equivalent; postgraduate degree preferred.
• 10+ years of cybersecurity experience, at least 5 years in leadership roles within financial institutions, fintechs, crypto exchanges or critical‑infrastructure environments.

Required skills

• Cryptographic key management, blockchain and smart‑contract security.
• Cloud security (AWS, GCP) and HSM, MPC, multisig implementations.
• SOC/SIEM operations, threat intelligence, vulnerability management.
• Penetration testing, red‑team exercises, DLP, IAM/PAM.
• Threat modelling, incident response and digital forensics.
• Knowledge of BCB Resolutions 85/2021, 520/2025, LGPD, ISO 27001, NIST CSF 2.0 and PCI DSS.