Director of Security

This is a fully remote position, open to applicants in United States.

📋 Description

• Establish and lead the security function for Sequencing from the ground up.

• Collaborate with Platform Engineering to create the security ownership map.

• Define policies, conduct assurance, and oversee application security, offensive security, and incident response leadership.

• Complete a HIPAA and HITECH assessment and present a prioritized remediation roadmap by day 45.

• Achieve SOC 2 readiness within six months.

• Formalize models for incident response severity, establish escalation paths, and coordinate executive communication and post-incident reviews.

• Expand security policies to encompass AI tooling and model providers, addressing data classification, acceptable use, and data-handling standards.

• Manage the security program, including policy development, risk register, security awareness and training, and GRC tooling.

• Scope and oversee external penetration-testing firms, triage findings, and drive remediation efforts.

• Conduct security reviews of third-party data flows, partner and marketplace applications, provider data sharing, marketing and analytics integrations, and AI model providers.

• Set security standards for contractors, agencies, and third-party development partners within a distributed workforce.

• Manage SaaS governance, shadow IT visibility, and identity lifecycle policies.

• Leverage AI for detection, log triage, evidence collection, policy and control drafting, as well as code and infrastructure review.

• Act as the escalation point for security incidents, including after-hours support when necessary.

• Report on security posture, risk, and roadmap to the founder and executive team.

• Convert security findings into actionable steps for engineering teams.

• Report to the Head of Engineering and collaborate with Platform Engineering, Bioinformatics, and AI functions.

• Recruit and mentor a small security team as the program develops.

⛳️ Requirements

• Over 8 years of experience in security.

• At least one tenure as the first or sole security leader in a company with fewer than a few hundred employees.

• Proven experience in guiding a company through SOC 2 compliance or establishing a HIPAA program from the ground up.

• ISO 27001 certification is advantageous.

• Practical experience in AWS and web application security.

• Proficiency in reading Terraform PRs, triaging penetration-testing findings, and fine-tuning WAF rules.

• Experience managing penetration tests through vendors, triaging results, and collaborating with engineers for resolution.

• Background in securing consumer-facing products at scale, including identity and account security, MFA, credential stuffing defense, session security, and account recovery abuse.

• Knowledge of privacy and breach obligations beyond HIPAA.

• Daily utilization of coding assistants and LLMs in security workflows.

• Experience presenting to a board, founder, or executive team during live incidents.

• Excellent written and verbal communication skills for conveying risk and tradeoffs to non-technical leaders.

• Preferred: experience in healthcare or genomics; familiarity with state genetic privacy laws; FTC Health Breach Notification Rule; state breach notification requirements; ecommerce or payment-processing security; ISO 27001; PCI DSS; Drupal security; GDPR and international data transfers; mobile application security; Vanta or Drata; SIEM; Cloudflare Enterprise; Zero Trust.

🏝️ Benefits

• Comprehensive medical, dental, and vision insurance coverage.

• 401(k) plan with company matching.

• Paid time off.

• Paid volunteer time off.

• Fully remote work opportunity.

• Provided equipment.

• Reimbursements for internet and cell phone expenses.

• Parental bonding leave.

• Private, confidential clinical-grade whole genome sequencing for you and your immediate family.