Blockchain Security Lead

Blockchain Lab analysis

Blockchain security across Galaxy's institutional business: the designs, the reviews, and the calls that stop a transfer.

It is not an IT helpdesk, and it is not a mandate to publish Galaxy's positions. Confidentiality is the product as much as the control.

Blockchain Lab analysis

Public reporting and the employer’s own releases. Not a relationship with Blockchain Lab. Not a credit opinion.

Founded

2018, by Michael Novogratz.

Base

New York, with a real London seat on this desk. Operates as Galaxy Digital Inc. on Nasdaq.

Status

Public. Equity, if you are offered it, is a listed stock, not a private option.

People

Michael Novogratz, founder, CEO and director. Christopher Ferraro, president and chief investment officer. Anthony Paquette, chief financial officer. Michael Daffey, chairman. Compensation figures below are FY2025 pay as compiled by Yahoo Finance, not equity wealth.

1. 2018

   Formation

   Founder capital, then a public listing in Canada

   Galaxy listed first on the Toronto Stock Exchange. The U.S. listing is Nasdaq: GLXY. This is not a venture-round story. Later capital is equity and project finance, including the Helios facility.

2. Dec 2022

   Helios acquisition

   About $65 million

   Bought the former Argo Blockchain site in Dickens County after the mining winter. The strategic act of the last four years is this purchase, not a Series D.

3. Mar 2025 onward

   CoreWeave lease

   15-year lease, 526 MW critical IT committed

   Galaxy has said the full build is expected to produce more than $1 billion in average annual revenue, and that Phase I alone is on the order of $300 million a year. Those are company projections, not recognised revenue.

• Earnings volatility. Three of the last reported quarters into mid-2026 were losses. A bull-market comp conversation and a drawdown comp conversation are different jobs.
• Key person. The franchise is still Novogratz's public voice.
• Helios execution and tenant concentration. One anchor, CoreWeave, on a multi-year lease is both the asset and the risk.
• Gross revenue headlines. Anyone who briefs you on '$60 billion revenue' without the net line is selling.

Ask them

• Which legal entity employs this seat, and is the bonus pool trading P&L, group, or the infrastructure segment?
• How much of blockchain security time is trading systems versus custody versus the data-centre estate?
• For the London role: right to work, hybrid days, and whether 'VP' is a Galaxy title band or a team of reports.
• What has Helios contributed to recognised revenue since rent started, as opposed to the $1 billion run-rate slide?

• Q2 2026 income statement, standardised
• Helios Phase I delivery, July 2026
• Yahoo Finance profile and FY2025 executive pay

If a figure is not in those sources, it is not in this brief on purpose.

Illustrative preparation

Not the employer’s onboarding plan.

1. Days 1–30: read the control stack and the last incident, under NDA. Do not propose a tool yet.
2. Days 31–60: one gap closed, with a retest. Leads who only write charters lose the team.
3. Days 61–90: a cadence with trading, custody, and engineering that survives the next volatile week.

A week you can rehearse

• Inventory the signing paths. Who can move what, with whose approval, on which chain.
• Separate market-abuse controls from key-management controls. They get conflated in pitches.
• Write the one-page threat model you would actually show a director.

Illustrative preparation

• Describe a finding you killed a release for, and the person you had to convince.
• How do you threat-model a principal trading desk that also custodies?
• What would you not put in a Slack channel?

Proof you can build before you apply

• The security-review lab: a threat model and one mitigation you can retest. Bring it. Do not bring a Galaxy-branded speculation.

Open Security review of a local demo. Review a local demo, write the threat model, and document one mitigation.

• Failure atlas
• Canon

• The seat reports into a function with no authority over trading exceptions.
• They want a name on the website more than a control.
• The bonus is entirely discretionary and they will not describe the year the desk lost money.

Employer stated. Galaxy is hiring a lead for blockchain security across an institutional digital-asset business, not a general IT helpdesk.

• Lead, mentor, and grow a team of blockchain security engineers.
• Define and evolve the blockchain security strategy and roadmap.
• Serve as a trusted security partner to product, protocol, and infrastructure teams.
• Lead threat modeling and architecture reviews for on-chain systems.
• Perform and guide security reviews and audits of smart contracts (Solidity, Rust/Solana) and backend services and supporting infrastructure.

Source: the employer’s public Greenhouse record, job 6019784004. Open the original. First seen by this desk 2026-10-06. Nothing above the fold is a substitute for that page.

Blockchain Lab analysis. These lines are a reading of the advertisement. They are not extra hiring requirements.

• Threat-model the privilege boundary before the bug list.
• Tie each finding to a concrete control, not a slogan.
• Show how you would re-test the fix.

• Compensation, unless a figure appears in the header. None of these eighteen postings stated one.
• Closing date, and the day the role was first published. The board timestamp is an update.
• Which countries may apply. “Remote” alone is not worldwide eligibility. If the employer wrote “worldwide”, that sentence is theirs — still ask which entity can hire you.
• Visa sponsorship, on-call, and the employing subsidiary.