Head of Security

Tonic; USA; Remote; USD 200.000 - 350.000; Vollzeit

Benefits dieser Stelle

Competitive compensation

Equity

Zusammenfassung

Tonic.ai is seeking a Head of Security to own our security program end-to-end, including audits, privacy, vendor risk, and customer security questionnaires.

You'll partner with founders, engineering, legal, and sales to set strategy, drive risk-based decisions, and implement AI governance across product and cloud infrastructure.

You'll lead SOC 2 readiness, oversee cloud security in AWS/GCP/Azure, and mentor a growing security team while protecting customer data.

Qualifikationen

• Prior leadership of security programs at a B2B software company.
• End-to-end SOC 2 audits ownership.
• Hands-on with AWS, GCP, and Azure IAM and security controls.
• Experience embedding security in the development lifecycle.
• Comfort presenting to customers and executives.
• Experience with corporate security and IT operations.
• AI governance and policy setting experience preferred.
• Self-directed and risk-based decision maker.
• Clear communication across technical and non-technical audiences.

Aufgaben

• Own SOC 2 program end to end and auditor relationships.
• Ensure GDPR/HIPAA alignment with security commitments.
• Embed security into the dev lifecycle from design to release.
• Lead vulnerability management across code and infra.
• Secure cloud environments (IAM, logging, hardening).
• Respond to security questionnaires and RFPs.
• Collaborate with legal on redlines.
• Oversee corporate security and IT operations.
• Manage IAM and vendor risk.
• Set AI usage policies and guardrails.

Kenntnisse

Security leadership

SOC 2 governance

Cloud security

Audits & compliance

Security questionnaires

RFP responses

Incident response

Executive communication

Vendor risk management

Ausbildung

Bachelor's degree in CS/Engineering

Tools

AWS

GCP

Azure

EDR

IAM policies

Jobbeschreibung

Tonic.ai has been de-identifying sensitive data since 2018, and hundreds of enterprises use our products, among them eBay, UnitedHealth Group, Qualcomm, Commonwealth Bank, and Mercor. Our customers hand us some of the most sensitive data they have: production databases, patient and financial records, and increasingly the email, chat, documents and code that AI labs want to train on.

That makes security part of what we sell, not just how we operate. Every deal runs through a security review, every customer asks how their data is protected, and the AI tools our own team uses every day raise new questions faster than most policies can keep up. We're looking for a Head of Security who can own all of it.

Why this role, why now

Our customers are getting bigger and more regulated, and our products now sit in the middle of AI training-data deals where the buyer, the seller and their lawyers all want proof that the data was handled safely. The bar for our own security program is rising with them. What keeps deals moving is a security leader who can pass the audit, answer the questionnaire, get on the call with a customer's CISO, and keep our own house in order at the same time.

That's this job. You'll be Tonic's senior security leader, working directly with our founders, engineering, DevOps, sales and legal. You'll own the program end to end, setting the strategy and doing much of the hands‑on work yourself.

What you'll do

• Own our SOC 2 program end to end: scoping, evidence collection, control remediation, and the auditor relationship.
• Keep our practices aligned with GDPR, HIPAA, and the security commitments in our customer contracts.
• Partner with engineering to build security into the development lifecycle, from design review through release, so products ship securely and on time.
• Run vulnerability management across our code, dependencies, and infrastructure, including pen tests and remediation tracking.
• Secure and govern our AWS, GCP, and Azure environments (IAM, configuration, logging, hardening), working closely with DevOps and backend engineers.
• Act as the customer‑facing security expert. Own security questionnaires and RFP responses, and join sales calls when a customer wants to go deep.
• Work with legal on contract negotiations and security redlines.
• Run corporate security and IT: endpoint management and laptop hardening, EDR monitoring, and incident response.
• Own identity and access management and vendor risk management across the company.
• Set and maintain policies and guardrails for employee AI use, including LLM platforms, coding assistants, and MCP connectors, covering access controls, data handling, and vendor review of AI providers.
• Keep those AI policies current as the landscape moves, so the team can adopt new tools quickly and safely.

What we're looking for

• Several years leading security at a B2B software company, with a record of building programs rather than inheriting them.
• SOC 2 audits owned end to end, plus working knowledge of GDPR and HIPAA.
• Hands‑on experience securing AWS, GCP, and Azure. You can read an IAM policy, spot a misconfiguration, and fix it with the engineer who owns it.
• Experience embedding security in the development lifecycle and running vulnerability management without becoming the team that slows everything down.
• Comfort in front of customers. You can answer a 300‑question security questionnaire, hold your own on a call with a customer's CISO, and work through redlines with legal.
• Experience running corporate security and IT: endpoint management, EDR, incident response, IAM, and vendor risk.
• AI‑native workflow. You use AI tools yourself, understand where they create real risk, and can write guardrails that people actually follow.
• Self‑direction. You'll be the security leader, and you'll need to make sound, risk‑based calls without waiting for someone to tell you what to do.
• Clear communication with very different audiences, from an engineer debugging a finding to an executive weighing a tradeoff.

Nice to haves

• Experience at a data infrastructure, privacy, or AI company.
• Experience selling into regulated industries such as healthcare and financial services.
• Experience with ISO 27001, HITRUST, or FedRAMP.
• Experience securing software that customers deploy in their own environments, alongside SaaS.
• Experience at an early‑stage or fast‑growing company.

What success looks like

In your first month, you'll learn our products, infrastructure, and current controls, take over the security questionnaire queue, and build a clear picture of our biggest risks. By the end of your first quarter, you'll own the SOC 2 program and auditor relationship, have a prioritized roadmap across product, cloud, and corporate security, and have AI‑use policies in place that the team actually follows. After that, you'll help shape how security grows at Tonic, including whether and when we hire next.

Why join

• You’ll own security at a company where security is part of the product, not a back‑office function.
• You’ll work directly with our founders, with a real say in how the company handles risk and makes commitments to customers.
• You’ll get close to the AI training‑data market and help set the bar for how sensitive data should be handled in it.
• You’ll shape AI governance in real time, at a company whose own business is making data safe for AI.
• Competitive compensation and equity.

Tonic.ai is an equal opportunity employer. We’re building a team that reflects the diversity of our users and the problems they’re trying to solve.

About Tonic.ai

Tonic.ai is the synthetic data platform that gives engineering teams on‑demand production‑like data for every workload, so they can test software and build AI safely without risking sensitive data exposure. Founded in 2018, Tonic.ai is trusted by thousands of developers worldwide at companies like eBay, UnitedHealth Group, Qualcomm, Commonwealth Bank, and Mercor. Learn more at www.tonic.ai , or follow @tonicfakedata on X and /tonicfakedata on LinkedIn.