Sheetal Joseph, Chief Information Security Officer, P2P.org

Today we're delighted to speak with Sheetal Joseph, Chief Information Security Officer at P2P.org. With over 20 years in cybersecurity spanning telecom, enterprise security at Cisco Systems, and the last seven years in digital assets, Sheetal brings a unique perspective on security in an industry where mistakes are irreversible. In this interview, she discusses her journey from systems administrator to CISO, the challenges of securing institutional staking infrastructure, and why trust and resilience - not just AI - will define the next era of fintech.

My questions are in bold - over to you Sheetal:

Who are you and what's your background?

I've been in cybersecurity for more than 20 years, although I don't think I ever sat down and decided, "I'm going to have a career in security." In some ways, it started much earlier, listening to my father's stories from the Army. Stories about defence, discipline, courage and resilience fascinated me, and growing up in an Army family meant those weren't just abstract ideas - they were part of everyday life.

We moved often, so I grew up adapting to new places, schools, people and cultures. I was also an incredibly curious child, always taking things apart to understand how they worked - and quite often figuring things out by breaking them. Looking back, that combination of curiosity, discipline, adaptability and resilience probably had a lot to do with why security became such a natural fit for me.

I studied computer engineering in India and later completed my master's at EPFL in Switzerland. I started my career as a systems administrator, moved into security consulting, and spent many years working across telecom and enterprise security, including at Cisco Systems, where I was the security subject matter expert supporting Mergers & Acquisitions.

Around seven years ago, I moved into fintech and digital assets. I led engineering teams before moving into CISO roles, first at Finoa, a regulated digital asset custodian, then at Bitvavo, a crypto exchange, and now at P2P.org. That journey has given me very different perspectives on digital assets - from custody and trading to staking and blockchain infrastructure.

I've always loved learning. I've picked up certifications in ethical hacking, ISO 27001 and CISSP along the way. But after this long in security, I've probably learned just as much from incidents, failures and things not going according to plan as I have from formal training. Security has a very good way of keeping you humble.

More recently, I've also become interested in what we can do beyond our own companies. I helped bring P2P.org into the Blockchain Security Standards Council, where we're working with others in the industry to develop practical standards for blockchain security, smart contracts and node operations.

It's been a long journey, but genuinely one I've loved. More than twenty years later, I'm still curious, still learning and still enjoying the challenge. If I could go back and choose again, I'd still choose security.

What is your job title and what are your general responsibilities?

As Chief Information Security Officer, I oversee the company's entire security program, including threat detection, incident response and cloud security, as well as governance and compliance in line with regulatory requirements.

In the simplest terms, my team safeguards the organisation's infrastructure, operations and people by focusing on attack prevention and cyber resilience. If we do have an incident, the job is to minimise any disruption and drive recovery as quickly as possible.

It's a role that sits at the intersection of multiple stakeholders. Internally, I work closely with our technical and engineering teams. Externally, I engage with regulators and the board, translating technical security matters into business language the board can act on, understanding their priorities and direction, and using that insight to continuously refine our security strategy. That's the core of what I do here.

Can you give us an overview of your business?

Founded in 2018, P2P.org helps institutional capital protect digital asset yield across non-custodial staking infrastructure and curated DeFi strategies. With over $10B in assets secured and operating on 40+ proof-of-stake networks, P2P.org has a zero-slashing incident track record, is trusted by over 190 institutional clients, and is SOC 2 Type II attested.

Tell us how you are funded?

We're revenue-driven and self-sustaining. Client fees fund day-to-day operations, so running the business doesn't depend on investor capital to keep the lights on. On top of that, we brought in outside funding to accelerate growth: Jump Crypto, Bybit, and Sygnum put in $23 million in 2023, on top of an earlier round, to help fund the shift from a product built for individual token holders into the institutional-grade infrastructure running today.

What's the origin story? Why did you join the company?

What initially drew me to crypto was the mathematics behind it, but also the security challenge. In very few industries can a single security failure be so immediate and so irreversible. There's no reversing a blockchain transaction or calling the bank to recover the money. That completely changes how you think about security.

I made that move about five years ago, joining Finoa, where I first learned the intricacies of crypto custody. From there, I moved into Bitvavo, which introduced me to the world of crypto trading. Staking was a newer area for me at the time, and it was something I was eager to learn and to bring my prior experience to.

What also appealed to me about P2P.org was the fully remote setup, and, honestly, the conversations I had with the board during the interview process. I came away with a strong sense that everyone at P2P.org is genuinely committed to doing things the right way. That combination, the technical challenge and the people, is ultimately what led me to join.

Who are your target customers? What's your revenue model?

Our customers are institutions holding digital assets at scale: exchanges, custodians, asset managers, wallets, foundations, organizations looking for ways to put those assets to work instead of letting them sit idle. Staking is where most of them start, but it's one piece of a broader institutional yield offering. Depending on what a client needs, that can mean earning network rewards via staking, or through curated DeFi strategies - all running through the same non-custodial infrastructure that they already trust, and is built to their expected security and compliance standards.

Revenue works the same way across the board. Institutions earn rewards on the assets they place with us, and we take an agreed share of that in exchange for running the infrastructure and carrying the operational, security, and compliance load underneath it. Over 190 institutions run on this model with us today, across more than 40 networks.

If you had a magic wand, what one thing would you change in the banking and/or FinTech sector?

I actually have a lot of appreciation for regulation. It gives security a strong foundation to build on, and it ensures the board stays engaged, because security becomes a regulatory requirement rather than a nice-to-have. We've built P2P.org around that principle from early on, which is part of why we already hold both the SOC 2 Type II attestation and a ISO/IEC 27001:2022 certification.

Where I struggle is when compliance starts consuming the capacity we need to deal with the actual threats. Some regulatory requirements don't fully account for the realistic capabilities of a smaller company with a lean security team. I value having clear requirements from regulatory bodies, but the real security problems a team faces aren't always the same as what regulation focuses on, and security teams need the capacity to address both. Right now, the regulatory load feels disproportionately high, and security teams are stretched trying to keep up with genuine threats, hackers, emerging AI-driven risks, while also meeting extensive compliance requirements.

So if I could change one thing, it would be making regulatory expectations more proportionate to a company's actual size and resources. Done right, that lets the whole industry build toward the kind of security posture we've already invested in, without stretching smaller teams past what they can realistically deliver.

What is your message for the larger players in the Financial Services marketplace?

Crypto looks very different today than it did even a few years ago, and I'd love for the CEOs and CIOs at the largest banks to take another look at it with that in mind. Companies like P2P.org operate under real scrutiny every day, and simply holding up to that scrutiny while maintaining strong controls says a lot about how seriously we take security and compliance.

Trust in this industry has to be built over time, and I think it genuinely has been. I'd encourage the larger banks to look past the caution that's understandable in a young industry, toward the innovation opportunities blockchain now offers within their own organizations. The institutions that engage early, rather than waiting for perfect certainty, are the ones that stand to benefit most as this space keeps maturing.

Where do you get your Financial Services/FinTech industry news from?

For security news specifically, I follow a number of podcasts hosted by people I genuinely admire in the field. For broader fintech and regulatory developments, I keep an eye on publications and blog posts from bodies like the EBA and CISA. For crypto-specific news, I turn to sources like Blockworks and CoinDesk. Beyond that, a lot of what I follow comes down to specific individuals and voices in the industry whose perspectives I value.

Can you list 3 people you rate from the FinTech and/or Financial Services sector that we should be following on LinkedIn, and why?

Pascal Gauthier, Chairman and CEO of Ledger. Ledger has been central to solving custody security at scale, at a moment when institutions need to trust hardware, not just software, with their keys.

Michael Shaulov, CEO and co-founder of Fireblocks. Fireblocks keeps solving the hard security problems underneath institutional digital asset infrastructure, which is a less visible fight than most people realize.

Esteban Castaño, CEO and co-founder of TRM Labs. TRM's work on blockchain intelligence is shaping how the industry actually detects and prevents crypto-related crime, not just talks about it.

What FinTech services (and/or apps) do you personally use?

I use N26, the Berlin-based neobank. I started with them early on, back when the company was just getting going, and appreciated how straightforward it was to open an account and get started from day one. They were among the first fintechs to offer a genuinely complete suite of digital banking services, and I've enjoyed watching their growth over the years.

More recently, I've also started using Revolut, whose growth trajectory has been remarkable in its own right. On the crypto side, I use Ledger for hardware wallet security given my background. Having reliable, secure self-custody tools is something I value personally as well as professionally.

What's the best new FinTech product or service you've seen recently?

I'm obviously biased, but one development I genuinely like is being able to stake directly through P2P.org from a Ledger wallet. What I like isn't simply the staking part, it's the security model. You can put your assets to work while keeping the keys in cold storage. You don't have to choose between participating and retaining custody.

Finally, let's talk predictions. What trends do you think are going to define the next few years in the FinTech sector?

I believe trust, more than AI, which is probably what people expect me to say, will be the defining factor for a company's success. Do customers trust the team behind the product, and how effectively is that team navigating new markets? That said, AI clearly matters too, particularly in how companies use it to improve their technology.

From a security standpoint, trust goes hand in hand with resilience. Even if a company experiences a cyberattack, its ability to recover and get back up and running makes a real difference. The reality is that no organization is ever 100 percent secure; there's always some probability of an incident. What matters is how well you contain that incident, how you handle it, and how effectively you recover. That's what builds real trust with customers, and I think it's going to be one of the defining trends going forward.

Many thanks to Sheetal for taking the time to share her insights with FinTech Profile. You can learn more about P2P.org on their website.