Director of Security

Prophecy • San Francisco, CA

4d

About The Position

Prophecy is hiring its first dedicated security leader to own security end-to-end as the company expands its AI-native data preparation and analysis platform. The Director of Security will lead a small team of security engineers and IT staff as a player-coach, setting strategy while remaining hands-on. The role spans product and AI security, cloud and infrastructure security, compliance, customer trust, and corporate security. The Director will partner with engineering teams across the US and India and with go-to-market teams serving security-conscious enterprise customers. This position reports directly to the CTO.

Prophecy has ISO/IEC 27001:2022 certification and SOC 1 Type II and SOC 2 Type II reports. The role will evolve the security program and compliance coverage, address security considerations for AI agents and customer data, and support customer trust and enterprise sales. The company also highlights its commitment to an inclusive culture and equal employment opportunity.

Requirements

• 10 or more years of experience in security, including at least 3 years in product, application, or cloud security at a software company.
• Experience leading a small security or IT team as a player-coach.
• Hands-on experience securing AWS and Kubernetes environments.
• Experience owning ISO/IEC 27001 and/or SOC 2 Type II programs, including audits and ongoing control management.
• Experience supporting enterprise sales through security reviews, questionnaires, and conversations with customer CISOs.
• Comfort acting as both strategist and hands-on practitioner as the first dedicated security leader at a fast-growing startup.
• Strong written and verbal communication skills, including the ability to explain technical risk to executives and customers.

Nice To Haves

• Experience securing AI/LLM-powered products, including prompt injection, agent permissioning, and data handling with third-party model providers.
• Background at a data platform or data infrastructure company such as Databricks, Snowflake, dbt, or Fivetran.
• Experience selling into regulated industries such as financial services, healthcare, or telecom.
• Experience working with distributed engineering teams across time zones.

Responsibilities

• Own Prophecy's security strategy and roadmap across product, cloud infrastructure, and corporate environments.
• Build and scale the security program, including policies, controls, risk assessments, and decisions about risk mitigation and acceptance.
• Partner with Engineering across the US and India to integrate security into the design, development, and release of AI agents and the data platform.
• Lead threat modeling for agentic systems, including tool and permission scoping, prompt injection defenses, credential handling, customer data isolation, and runtime monitoring.
• Lead AI governance for the agent platform, building on alignment with the EU AI Act and NIST frameworks and addressing customer data flows through models and third-party LLM providers.
• Lead application security practices, including secure code review, vulnerability management, penetration testing, and secure-by-default engineering standards.
• Secure integrations with Databricks, Snowflake, BigQuery, and other customer data platforms.
• Set guardrails for internally operated agents, including least-privilege access, short-lived credentials, and human approval for high-risk actions.
• Review internal agents and AI tools before production or customer-data access; set employee AI-use policy; and extend logging and incident response to agent activity.
• Build security-team agents, such as tools for questionnaire automation and alert triage.
• Own the security posture of AWS and Kubernetes environments, including identity and access management, secrets management, logging, and detection.
• Build and run incident response from detection and triage through post-incident review and remediation.
• Own and evolve ISO/IEC 27001:2022, SOC 1 Type II, and SOC 2 Type II compliance programs, maintaining continuous audit readiness and expanding coverage as needed.
• Own data privacy compliance across operating regions, including GDPR, CCPA, and India's DPDP Act.
• Lead customer security reviews, questionnaires, and trust documentation for enterprise and regulated-industry customers.
• Join customer calls with CISOs and security teams to address security questions and help close deals.
• Partner with IT and People on access management, device security, vendor risk, and security awareness across the company.

Benefits

• Prophecy covers 99% of employee health insurance premiums and 75% of dependent premiums.
• Discretionary allowance for cell phone, Wi-Fi, gym memberships, wellness, and more.
• Flexible PTO.
• Professional development allowance.
• Company-sponsored long-term disability and life insurance.
• FSA/HSA, dental, and vision coverage.
• Opportunity to contribute directly to an innovative product and have end-to-end ownership of projects.
• Benefits and perks may vary by country.

What This Job Offers

• Job Type: Full-time
• Career Level: Director
• Education Level: No Education Listed