Head of Security

This is a fully remote position, open to applicants in United States.

📋 Description

• Take full ownership of Tonic's SOC 2 program, managing everything from scoping and evidence collection to control remediation and maintaining auditor relationships.

• Ensure compliance with GDPR, HIPAA, and security commitments outlined in customer contracts.

• Collaborate with the engineering team to incorporate security measures throughout the development lifecycle, from design reviews to release.

• Oversee vulnerability management across code, dependencies, and infrastructure, which includes conducting penetration testing and tracking remediation efforts.

• Safeguard and manage AWS, GCP, and Azure environments, focusing on IAM, configuration, logging, and hardening processes.

• Act as the security expert for customers, responsible for managing security questionnaires and responding to RFPs.

• Participate in sales calls that involve in-depth discussions on customer security needs.

• Collaborate with the legal team during contract negotiations and handle security-related redlines.

• Manage corporate security and IT operations, including endpoint management, laptop hardening, EDR monitoring, and incident response activities.

• Take charge of identity and access management along with vendor risk management.

• Develop and maintain employee policies and guidelines for AI usage, covering LLM platforms, coding assistants, MCP connectors, access controls, data handling, and reviews of AI providers.

• Keep AI policies updated in response to the evolving security landscape.

• Familiarize yourself with products, infrastructure, and controls; take over the security questionnaire queue; and evaluate major risks within the first month.

• Manage the SOC 2 program and auditor relationship, create a prioritized security roadmap, and implement effective AI-use policies in the first quarter.

• Assist in determining the growth trajectory of Tonic's security function and the timing for hiring additional staff.

⛳️ Requirements

• Several years of experience leading security initiatives at a B2B software company, with a proven track record of building security programs from the ground up.

• Comprehensive experience managing SOC 2 audits end to end, alongside a solid understanding of GDPR and HIPAA regulations.

• Practical experience securing AWS, GCP, and Azure environments.

• Proficiency in reading IAM policies and identifying misconfigurations, with the ability to remediate them in collaboration with engineering teams.

• Experience in embedding security practices within the software development lifecycle.

• Background in managing vulnerability assessments and remediation processes.

• Customer-facing experience, particularly with security questionnaires, discussions with CISOs, and legal redlining.

• Experience overseeing corporate security and IT functions, including endpoint management, EDR, incident response, IAM, and vendor risk management.

• Familiarity with AI tools and the ability to create effective AI security guardrails.

• Capacity to make independent, risk-based decisions.

• Strong communication skills with both engineers and executives.

• Background in data infrastructure, privacy, or AI companies is advantageous.

• Experience selling to regulated industries is a plus.

• Familiarity with ISO 27001, HITRUST, or FedRAMP standards is beneficial.

• Experience securing customer-deployed software alongside SaaS offerings is an advantage.

• Previous work experience in early-stage or rapidly growing companies is a plus.

🏝️ Benefits

• Competitive salary and equity compensation.

• Unlimited paid time off.

• 401k plan with employer contributions.

• Comprehensive medical, dental, and vision insurance.

• Generous parental leave policy.

• Remote-friendly work environment.