Head of Security

As our Head of Security you will build and lead the company's security program as it scales into a trusted enterprise platform. This is a foundational, high-impact role: you'll own security strategy end-to-end while staying hands-on, working alongside an existing Security Engineer to mature Profound's program from "does the right things" to "provably does the right things at enterprise scale." You'll also own IT for the company, making this a role that spans technical security leadership and the practical, day-to-day systems that keep the company running securely. This is a player-coach role. You should be comfortable setting strategy and talking to enterprise customers' security teams one day, and rolling up your sleeves on a threat model, an incident, or an endpoint policy the next.

Responsibilities

Own and evolve Profound's overall security strategy, roadmap, and risk posture as the company scales; Own the build-out and growth of the entire security function and team; Serve as the executive-level owner of security in customer conversations, RFPs, and security reviews with enterprise and Fortune 100 prospects and customers; Partner closely with Engineering, Product, and Leadership to embed security into the SDLC and product roadmap; Own and mature Profound's compliance posture (SOC 2 Type II and beyond — e.g. ISO 27001, GDPR, and other frameworks as enterprise customers require); Drive audits, policy development, vendor risk management, and control operations; Manage relationships with auditors, pen testers, and security vendors; Provide technical direction and oversight for application security, cloud security (AWS/GCP), and infrastructure hardening; Own incident response: build the program, run tabletop exercises, and lead the response when needed; Guide and review the Security Engineer's work on detection, vulnerability management, and secure architecture; Evaluate and implement security tooling (SIEM, EDR, vulnerability scanning, etc.); Own IT operations for the company: identity and access management (SSO/MDM), endpoint security, employee onboarding/offboarding, SaaS security posture, and internal tooling; Set and enforce IT policies that scale with headcount growth without creating unnecessary friction

Requirements

8+ years in security, with progressively increasing scope, including experience owning a security program (not just executing within one); Hands-on technical depth — comfortable engaging directly on application security, cloud security, and incident response; Direct experience owning SOC 2 (Type II) and driving compliance programs; Experience leading and developing a small team; Comfortable being the face of security to enterprise customers, including technical security reviews and questionnaires; Excellent communicator who can translate technical risk into business terms for executives and customers alike

Nice to have

Prior experience as a first or early security hire at a high-growth startup, ideally SaaS/B2B, strongly preferred; Experience with additional frameworks (ISO 27001, GDPR, etc.) a plus; Experience owning or partnering closely with IT function preferred

Benefits

Equity; Full range of benefits and perks