The pathway
How you actually get there, here
How you become one varies far more by country than what one does. This is the UK route. Most people take one of these ways in; the right one depends on where you're starting from.
- 1
Principal Security Architect (Web3)
3-5 years in this role before DirectorSkills to master
- Deep technical authority, strategic tooling selection, cross-functional influence, and the ability to design security for entire protocols. You'd have been the final technical word on major security decisions.
You're ready to move on when
- Successfully led the security architecture for multiple complex, high-value Web3 protocols.
- Mentored a team of senior engineers and demonstrated strong technical leadership.
- Influenced product strategy through security insights.
- Consistently delivered on major security initiatives with significant business impact.
- 2
Head of Security Engineering (Web3)
2-4 years in this role before DirectorSkills to master
- Building and managing a team of 10-20+ security engineers, owning the security SDLC, and driving the implementation of security tools and processes. You'd have been responsible for the day-to-day operational security.
You're ready to move on when
- Successfully scaled a Web3 security engineering team and managed their performance.
- Owned and improved the secure development lifecycle for a significant product portfolio.
- Demonstrated strong project management and resource allocation skills.
- Effectively managed a security budget and achieved measurable improvements in security posture.
- 3
Senior Manager, Web3 Security Operations
4-6 years in this role before DirectorSkills to master
- Leading incident response, managing a large security operations centre (SOC) for Web3, and developing advanced threat detection capabilities. You'd have been on the front lines, responding to and learning from every attack.
You're ready to move on when
- Successfully led multiple critical Web3 incident responses from detection to post-mortem.
- Built and optimised an on-chain monitoring and alerting system.
- Managed a 24/7 security operations team.
- Demonstrated ability to learn from incidents and implement preventative measures at scale.