Head of Security

Tonic.ai has been de-identifying sensitive data since 2018 and works with enterprises such as eBay, UnitedHealth Group, Qualcomm, Commonwealth Bank, and Mercor. The company is looking for a Head of Security to own its security program end to end, serving as Tonic's senior security leader and working directly with founders, engineering, DevOps, sales, and legal. Tonic.ai is an equal opportunity employer.

Responsibilities

Own the SOC 2 program end to end, including scoping, evidence collection, control remediation, and the auditor relationship; Keep practices aligned with GDPR, HIPAA, and customer contract security commitments; Partner with engineering to build security into the development lifecycle; Run vulnerability management across code, dependencies, and infrastructure, including pen tests and remediation tracking; Secure and govern AWS, GCP, and Azure environments (IAM, configuration, logging, hardening); Act as the customer-facing security expert, owning security questionnaires and RFP responses and joining sales calls; Work with legal on contract negotiations and security redlines; Run corporate security and IT, including endpoint management, EDR monitoring, and incident response; Own identity and access management and vendor risk management; Set and maintain policies and guardrails for employee AI use, and keep them current

Requirements

Several years leading security at a B2B software company, with a record of building programs rather than inheriting them; SOC 2 audits owned end to end, plus working knowledge of GDPR and HIPAA; Hands-on experience securing AWS, GCP, and Azure; Experience embedding security in the development lifecycle and running vulnerability management; Comfort in front of customers, including answering security questionnaires, speaking with a customer's CISO, and working through redlines with legal; Experience running corporate security and IT: endpoint management, EDR, incident response, IAM, and vendor risk; AI-native workflow, using AI tools and writing guardrails people follow; Self-direction and making sound, risk-based decisions; Clear communication with very different audiences

Nice to have

Experience at a data infrastructure, privacy, or AI company; Experience selling into regulated industries such as healthcare and financial services; Experience with ISO 27001, HITRUST, or FedRAMP; Experience securing software that customers deploy in their own environments, alongside SaaS; Experience at an early-stage or fast-growing company

Benefits

Competitive salary and equity; Unlimited paid time off; 401k plan with employer contribution; Medical, dental, and vision insurance; Generous parental leave policy; Remote-friendly work environment