Head of Information Security

Jobtailor; Seattle (WA); On-site; USD 150,000 - 210,000; Full time

Job summary

Humanly is seeking a senior security and governance leader to own and scale the data security, privacy, and AI governance programs. You will establish robust policies, drive audit readiness, and partner with engineering on secure SDLC and access governance.

You will design security awareness, lead incident response with legal, and maintain continuity and disaster recovery plans while maturing the privacy program across GDPR and CCPA. Strong builder mindset and commercial focus are essential.

Qualifications

• 5+ years in information security.
• Experience owning a compliance program end-to-end, including SOC 2.
• Experience in regulated environments (GDPR/CCPA or similar).
• Builder mindset with ability to assess, decide, and build.
• Commercial orientation; translate trust into revenue.
• AI governance familiarity and risk management.
• Ability to engage from vendor contracts to leadership advisement.

Responsibilities

• Own and scale the data security, compliance, and AI governance program for Humanly.
• Establish, maintain, and improve policies, procedures, and controls across functions.
• Own certification and audit roadmap; partner with engineering on secure SDLC and access governance.
• Design and run security awareness programs and training for engineers and high-risk roles.
• Lead security incident response and post-incident reviews with legal.
• Maintain and test business continuity and disaster recovery plans.
• Own the privacy program across GDPR/CCPA including DSARs and DPAs.
• Build and operate the AI governance framework with risk classification and monitoring.
• Maintain enterprise risk register for security, AI, privacy, and third-party risk.
• Lead security and trust narratives for RFIs/RFPs and security questionnaires.

Skills

information security

compliance program management

SOC 2

GDPR

CCPA

AI governance

vulnerability management

security incident response

business continuity planning

disaster recovery

Job description

Responsibilities

• Own and scale the data security, compliance, and AI governance program for Humanly
• Establish, maintain, and continuously improve the policies, procedures, and controls that protect the company and drive adoption across every function
• Own the certification and audit roadmap and partner with engineering on secure SDLC, vulnerability management, and access governance
• Design and run the security awareness program - onboarding, annual training, phishing simulations, and role-based training for engineers and high-risk functions
• Own the security incident response plan and lead detection, containment, investigation, breach notification decisions, and post-incident review in partnership with legal
• Maintain and regularly test business continuity and disaster recovery plans
• Own the privacy program across GDPR, CCPA/CPRA, including data subject rights workflows, DPAs, and sub-processor disclosures
• Build and operate the AI governance framework - model inventory, risk classification, review and approval, bias and fairness testing, and ongoing monitoring
• Maintain an enterprise risk register covering security, AI, privacy, and third-party risk, and drive periodic assessments and remediation
• Own the security and trust narrative for prospects and customers, leading responses to RFIs, RFPs, and security questionnaires alongside GTM

Requirements

• 5+ years in information security
• You've owned a compliance program end-to-end and not just contributed to one. You know what it takes to get to SOC 2, and what comes after
• You've operated in a regulated environment (GDPR, CCPA, or similar) and understand privacy not as a legal checkbox but as a product and trust issue
• Builder mindset. You can assess what's in place, decide what's worth keeping, and build what isn't there yet, without waiting for a team under you
• Commercial orientation. You've sat in customer calls, answered security questionnaires, and know how to turn trust into a revenue lever rather than a deal blocker
• AI governance experience, or strong familiarity with the emerging landscape. You understand the specific risks AI introduces in a data-sensitive product and have opinions on how to manage them
• Tactical-to-strategic range. You can go from reviewing a vendor contract to advising leadership, and you're comfortable with both
• AI fluency in your own work. You're already using AI tools to multiply your efforts, not just governing others' use of them

Hard Skills

• information security
• compliance program management
• SOC 2
• GDPR
• CCPA
• AI governance
• vulnerability management
• security incident response
• business continuity planning
• disaster recovery

Soft Skills

• builder mindset
• commercial orientation
• tactical-to-strategic range
• leadership
• communication
• problem-solving
• collaboration
• adaptability
• critical thinking
• customer engagement