Head of Security

Remote. Posted 5 days ago

The role

The Head of Security will own the security program end to end, setting strategy and performing hands-on work. This person will work with founders, engineering, DevOps, sales, and legal to manage SOC 2, cloud security, and AI governance.

What you will do

Own the SOC 2 program including scoping, evidence collection, control remediation, and auditor relationship
Keep practices aligned with GDPR, HIPAA, and customer contract security commitments
Partner with engineering to build security into the development lifecycle
Run vulnerability management across code, dependencies, and infrastructure
Secure and govern AWS, GCP, and Azure environments
Act as the customer-facing security expert for questionnaires, RFPs, and sales calls
Work with legal on contract negotiations and security redlines
Run corporate security and IT including endpoint management, EDR monitoring, and incident response
Own identity and access management and vendor risk management
Set and maintain policies and guardrails for employee AI use

Required qualifications

Several years leading security at a B2B software company
SOC 2 audits owned end to end
Working knowledge of GDPR and HIPAA
Hands-on experience securing AWS, GCP, and Azure
Experience embedding security in the development lifecycle and running vulnerability management
Comfort answering security questionnaires and speaking with customer CISOs
Experience running corporate security and IT: endpoint management, EDR, incident response, IAM, and vendor risk
AI-native workflow
Self-direction to make risk-based calls
Clear communication with different audiences

Nice to have

Experience at a data infrastructure, privacy, or AI company
Experience selling into regulated industries such as healthcare and financial services
Experience with ISO 27001, HITRUST, or FedRAMP
Experience securing software that customers deploy in their own environments, alongside SaaS
Experience at an early-stage or fast-growing company

Benefits

Competitive salary and equity
Unlimited paid time off
401k plan with employer contribution
Medical, dental, and vision insurance
Generous parental leave policy

About the company

Tonic.ai has been de-identifying sensitive data since 2018. Hundreds of enterprises use their products to handle sensitive production databases, patient and financial records, and AI training data.