Head of Security

Tonic.ai; San Francisco (CA); On-site; USD 250,000 - 360,000; Full time

Benefits offered by this job

Competitive salary and equity

Unlimited paid time off

401k plan with employer contribution

Medical, dental, and vision insurance

Generous parental leave policy

Remote-friendly work environment

Job summary

Tonic.ai is seeking a Head of Security to own the program end-to-end, working closely with founders, engineering, DevOps, sales and legal to secure data and products in a fast-moving AI data-trading environment.

You will lead SOC 2, drive audits, shape cloud security across AWS, GCP, and Azure, and set guardrails for AI usage, vendor risk, and incident response.

Qualifications

• Several years leading security at a B2B software company
• SOC 2 audits owned end to end; familiarity with GDPR/HIPAA
• Hands-on experience securing AWS, GCP, and Azure
• Experience embedding security in the software development lifecycle
• Comfort in front of customers and with security questionnaires
• Experience running corporate security and IT operations
• AI-native workflow; write practical guardrails
• Self-directed leader who makes risk-based decisions
• Excellent cross-functional communication

Responsibilities

• Own our SOC 2 program end to end: scoping, evidence collection, remediation, auditor relationship
• Keep practices aligned with GDPR, HIPAA, and customer security commitments
• Partner with engineering to integrate security into development lifecycle
• Run vulnerability management across code, dependencies, and infrastructure
• Secure and govern AWS, GCP, and Azure environments with DevOps
• Lead customer-facing security discussions and respond to security questionnaires
• Collaborate with legal on contract negotiations and redlines
• Oversee corporate security and IT: endpoints, EDR, incident response, IAM, vendor risk
• Set AI-use policies and guardrails for tools and providers
• Maintain security policies and adapt to evolving AI landscape
• Maintain strong, proactive security posture across the company

Skills

SOC 2 ownership

Cloud security

Vulnerability management

IAM management

Security policies

Customer security talks

Security guidance

Clear communication

Self-direction

Education

Bachelor’s degree in a related field

Tools

AWS

GCP

Azure

Job description

Tonic.ai has been de-identifying sensitive data since 2018, and hundreds of enterprises use our products, among them eBay, UnitedHealth Group, Qualcomm, Commonwealth Bank, and Mercor. Our customers hand us some of the most sensitive data they have: production databases, patient and financial records, and increasingly the email, chat, documents and code that AI labs want to train on.

That makes security part of what we sell, not just how we operate. Every deal runs through a security review, every customer asks how their data is protected, and the AI tools our own team uses every day raise new questions faster than most policies can keep up. We're looking for a Head of Security who can own all of it.

Why This Role, Why Now

Our customers are getting bigger and more regulated, and our products now sit in the middle of AI training-data deals where the buyer, the seller and their lawyers all want proof that the data was handled safely. The bar for our own security program is rising with them. What keeps deals moving is a security leader who can pass the audit, answer the questionnaire, get on the call with a customer's CISO, and keep our own house in order at the same time.

That's this job. You'll be Tonic's senior security leader, working directly with our founders, engineering, DevOps, sales and legal. You'll own the program end to end, setting the strategy and doing much of the hands-on work yourself.

What You'll Do

• Own our SOC 2 program end to end: scoping, evidence collection, control remediation, and the auditor relationship.




• Keep our practices aligned with GDPR, HIPAA, and the security commitments in our customer contracts.




• Partner with engineering to build security into the development lifecycle, from design review through release, so products ship securely and on time.




• Run vulnerability management across our code, dependencies, and infrastructure, including pen tests and remediation tracking.




• Secure and govern our AWS, GCP, and Azure environments (IAM, configuration, logging, hardening), working closely with DevOps and backend engineers.




• Act as the customer-facing security expert. Own security questionnaires and RFP responses, and join sales calls when a customer wants to go deep.




• Work with legal on contract negotiations and security redlines.




• Run corporate security and IT: endpoint management and laptop hardening, EDR monitoring, and incident response.




• Own identity and access management and vendor risk management across the company.




• Set and maintain policies and guardrails for employee AI use, including LLM platforms, coding assistants, and MCP connectors, covering access controls, data handling, and vendor review of AI providers.




• Keep those AI policies current as the landscape moves, so the team can adopt new tools quickly and safely.

What We're Looking For

• Several years leading security at a B2B software company, with a record of building programs rather than inheriting them.




• SOC 2 audits owned end to end, plus working knowledge of GDPR and HIPAA.




• Hands-on experience securing AWS, GCP, and Azure. You can read an IAM policy, spot a misconfiguration, and fix it with the engineer who owns it.




• Experience embedding security in the development lifecycle and running vulnerability management without becoming the team that slows everything down.




• Comfort in front of customers. You can answer a 300-question security questionnaire, hold your own on a call with a customer's CISO, and work through redlines with legal.




• Experience running corporate security and IT: endpoint management, EDR, incident response, IAM, and vendor risk.




• AI-native workflow. You use AI tools yourself, understand where they create real risk, and can write guardrails that people actually follow.




• Self-direction. You'll be the security leader, and you'll need to make sound, risk-based calls without waiting for someone to tell you what to do.




• Clear communication with very different audiences, from an engineer debugging a finding to an executive weighing a tradeoff.

Nice to Haves

• Experience at a data infrastructure, privacy, or AI company.




• Experience selling into regulated industries such as healthcare and financial services.




• Experience with ISO 27001, HITRUST, or FedRAMP.




• Experience securing software that customers deploy in their own environments, alongside SaaS.




• Experience at an early-stage or fast-growing company.

What Success Looks Like

In your first month, you'll learn our products, infrastructure, and current controls, take over the security questionnaire queue, and build a clear picture of our biggest risks. By the end of your first quarter, you'll own the SOC 2 program and auditor relationship, have a prioritized roadmap across product, cloud, and corporate security, and have AI-use policies in place that the team actually follows. After that, you'll help shape how security grows at Tonic, including whether and when we hire next.

Why Join

• You'll own security at a company where security is part of the product, not a back-office function.




• You'll work directly with our founders, with a real say in how the company handles risk and makes commitments to customers.




• You'll get close to the AI training-data market and help set the bar for how sensitive data should be handled in it.




• You'll shape AI governance in real time, at a company whose own business is making data safe for AI.




• Competitive compensation and equity.

Benefits We Offer

• Competitive salary and equity




• Unlimited paid time off




• 401k plan with employer contribution




• Medical, dental, and vision insurance




• Generous parental leave policy




• Remote-friendly work environment

Tonic.ai is an equal opportunity employer. We're building a team that reflects the diversity of our users and the problems they're trying to solve.