Head of Security

Role overview Own the security program for a software business that handles sensitive customer data, setting direction while carrying out much of the work directly. The remit spans compliance, product and cloud security, corporate IT, customer assurance, and governance of employee AI tools. You will work with engineering, operations, sales, legal, and company leadership to reduce risk and support customer requirements.

Responsibilities - Run SOC 2 from scoping and evidence collection through control remediation and auditor coordination; maintain alignment with GDPR, HIPAA, and customer commitments. - Integrate security reviews into product design and release, and manage vulnerability testing and remediation across code, dependencies, and infrastructure. - Secure cloud environments across AWS, GCP, and Azure, including identity, configuration, logging, and hardening. - Lead customer security questionnaires and RFP responses, participate in technical discussions with customer security leaders, and support security contract negotiations. - Oversee corporate security and IT, including endpoint protections, incident response, identity and access management, and vendor risk. - Set and update practical controls for employee AI tools, covering access, data handling, and provider reviews.

Requirements - Several years leading and building security programs at a B2B software company. - Hands-on experience owning SOC 2 audits and working knowledge of GDPR and HIPAA. - Practical cloud security experience across AWS, GCP, and Azure, including the ability to identify and resolve configuration or access issues with engineers. - Experience embedding security into software development and running vulnerability management. - Background in corporate security operations, including endpoint management, incident response, IAM, and vendor risk. - Clear communication with technical, customer, legal, and executive audiences; able to make independent, risk-based decisions. - Familiarity with AI tools and the security risks they introduce, with the ability to write usable policies.

Nice to have - Experience in data infrastructure, privacy, or AI, or selling into regulated sectors such as healthcare or finance. - Familiarity with ISO 27001, HITRUST, or FedRAMP, or with software deployed in customer environments. - Experience at an early-stage or fast-growing company.

Benefits and work setup - Remote-friendly work environment, competitive compensation and equity, paid time off, employer-supported retirement, health, dental, and vision coverage, and parental leave.