Director of Security

Prophecy • San Francisco, CA

6h

About The Position

Prophecy is hiring its first dedicated security leader to own security end-to-end as the company serves large enterprises with sensitive, business-critical data. The Director of Security will lead a small team of security engineers and IT staff as a player-coach, setting strategy while remaining hands-on. The role spans product and AI security, cloud and infrastructure security, compliance, customer trust, and corporate security. The Director will partner with engineering teams across the US and India and with go-to-market teams selling to security-conscious enterprises. This position reports directly to the CTO.

Requirements

• 10+ years of experience in security, including at least 3 years in product, application, or cloud security at a software company.
• Experience leading a small security or IT team as a player-coach.
• Hands-on experience securing AWS and Kubernetes environments.
• Experience owning ISO/IEC 27001 and/or SOC 2 Type II programs, including audits and ongoing control management.
• Experience supporting enterprise sales through security reviews, questionnaires, and customer CISO conversations.
• Ability to work as both a strategist and hands-on practitioner as the first dedicated security leader at a fast-growing startup.
• Strong written and verbal communication skills, including translating technical risk for executives and customers.

Nice To Haves

• Experience securing AI/LLM-powered products, including prompt injection, agent permissioning, and data handling with third-party model providers.
• Background at a data platform or data infrastructure company such as Databricks, Snowflake, dbt, or Fivetran.
• Experience selling into regulated industries such as financial services, healthcare, or telecom.
• Experience working with distributed engineering teams across time zones.

Responsibilities

• Own Prophecy's security strategy and roadmap across product, cloud infrastructure, and corporate environments.
• Build and scale the security program, including policies, controls, risk assessments, and decisions about risk mitigation and acceptance.
• Partner with Engineering teams across the US and India to embed security into the design, development, and release of AI agents and the data platform.
• Own threat modeling for agentic systems, including tool and permission scoping, prompt injection defenses, credential handling, customer data isolation, and runtime monitoring.
• Lead AI governance for the agent platform, building on alignment with the EU AI Act and NIST frameworks, including governance of customer data flows through models and third-party LLM providers.
• Lead application security practices, including secure code review, vulnerability management, penetration testing, and secure-by-default engineering standards.
• Secure integrations with Databricks, Snowflake, BigQuery, and other customer data platforms.
• Set guardrails for internal agents, including least-privilege access, short-lived credentials, and human approval for high-risk actions.
• Review internal agents and AI tools before they access production or customer data, set employee AI-use policies, and extend logging and incident response to agent activity.
• Build security-team agents for tasks such as questionnaire automation and alert triage.
• Own the security posture of AWS and Kubernetes environments, including identity and access management, secrets management, logging, and detection.
• Build and run incident response from detection and triage through post-incident review and remediation.
• Own and evolve compliance programs, including ISO/IEC 27001:2022, SOC 1 Type II, and SOC 2 Type II, maintaining continuous audit readiness and expanding coverage as needed.
• Own data privacy compliance across operating regions, including GDPR, CCPA, and India's DPDP Act.
• Lead security reviews, questionnaires, and trust documentation for enterprise and regulated-industry customers.
• Join customer calls with CISOs and security teams to answer security questions and help close deals.
• Partner with IT and People on access management, device security, vendor risk, and company-wide security awareness.

Benefits

• Prophecy covers 99% of employee health insurance premiums and 75% of dependent premiums.
• Discretionary allowance for cell phone, Wi-Fi, gym memberships, wellness, and more.
• Flexible PTO.
• Professional development allowance.
• Company-sponsored Long Term Disability and Life Insurance.
• FSA/HSA, dental, and vision.
• Opportunity to have a direct impact on an innovative product and end-to-end ownership of projects.

What This Job Offers

• Job Type: Full-time
• Career Level: Director
• Education Level: No Education Listed