Head of Security and Privacy

HushOne, Inc.; Kirkland (WA); On-site; USD 120,000 - 160,000; Full time

Benefits offered by this job

Stock options

AI tokens

Gym membership

401(k) with company match

Health, dental and vision insurance

Job summary

HushOne, Inc. is seeking a security engineer to own the threat model across hardware, software, people and external agents, and to define release criteria, incident response and vulnerability handling.

In your first 90 days you will establish the security architecture, test the highest‑risk boundaries and run an incident and device‑loss recovery exercise, while teaching threat modelling and guiding product teams through cryptographic design reviews.

Qualifications

• Hands-on security engineering experience
• Ability to explain decisions under uncertainty
• Ability to teach threat modelling credibly
• Collaborates with product teams, not blocking them

Responsibilities

• Own the threat model across hardware, software, people and external agents
• Define release security criteria, incident response and vulnerability handling
• Review custody, authentication, authorization, update integrity and data deletion with engineers

Skills

Threat modeling

Security engineering

Decision making under uncertainty

Teach threat modelling

Cryptographic design review

Cross‑functional collaboration

Tools

NIST 800‑53

FedRAMP

Job description

You earn the right to hold a person's most sensitive information, and you do it by making protection, consent and recovery part of every engineering decision rather than a review at the end. You own the threat model across hardware, software, people and external agents, plus release criteria, incident response and vulnerability handling.

The work:

Own the threat model across hardware, software, people and external agents. Define release security criteria, incident response and vulnerability handling. Review key custody, authentication, authorization, update integrity and data deletion with the engineers who build them.

What good looks like:

In your first 90 days, establish the security architecture, test the highest-risk boundaries and run an incident and device-loss recovery exercise.

Evidence we look for:

Bring hands-on security engineering and experience making clear decisions under uncertainty. You should be able to teach threat modeling, review cryptographic system design and work constructively with product teams.

Required:

• Hands-on security engineering, current enough that you could still do the work
• You make clear decisions under genuine uncertainty and can explain the reasoning afterwards
• You can teach threat modelling and review a cryptographic design credibly
• You work constructively with product teams rather than only blocking them

Nice to have:

• Consumer-device or endpoint security specifically
• You have run an incident that went public and handled it well
• NIST 800-53, FedRAMP, or equivalent control-framework experience

The exercise:

Threat-model a household with separate users, an untrusted plugin and a stolen device; explain what remains at risk.

How we work:

We work together in the office, five days a week, and you can be based at any of our garages: Kirkland Garage (Kirkland, WA); UAE Garage (Dubai, Dubai). We hire across the United States, India and the UAE. We are remote-friendly around family: if you need to work from home some days to look after the people you love, we arrange that with you one person at a time, and we encourage people to use it rather than tough it out.

Pay:

We publish what we pay. Indicative ranges by market and level are on our compensation page, and they are realistic going market rates rather than headline numbers. Wherever we hire we pay at least the local market rate, and for full-time roles our floor is a living wage, never the statutory minimum. Compensation is reviewed every year and on promotion.

Equity:

Every full-time teammate gets stock options. Four-year vesting with a one-year cliff, sized to role, level and impact, and confirmed in writing at offer. High performers earn refresh grants.

Bonus and commission:

An annual performance bonus tied to clear company and personal goals, indicatively 10 to 20 percent of base for non-sales roles. Customer-facing roles carry on-target earnings, typically a 50/50 split of base and variable, with uncapped commission and accelerators above quota.

Health and peace of mind:

Medical, dental and vision for you and your family, plus life and disability cover. We have chosen the highest plan tier available to us rather than the cheapest one that clears the bar, because the point of this is that you never have to think about it. The specific plan numbers are confirmed in your offer letter.

401(k) with company matching:

A 401(k) with a company match, so the years you spend here compound into something that is yours whatever happens next. The match formula is confirmed in your offer letter.

AI tokens:

A budget of AI tokens of your own, because a company that says you should own your AI cannot be the company that rations it. Use them on the work and on whatever you are curious about.

Gym, and the everyday things:

A gym membership, and a corporate benefits programme with its own app, where you redeem real discounts with a long list of retailers on the ordinary purchases of a life.

Family:

We are remote-friendly around your family, arranged one person at a time, and we would rather you took it than toughed it out.

Referrals:

Refer someone we hire full-time who stays a year and you get $1,000 plus $10,000 in referral stock-based equity, on top of your own package.