Head of Information Security & IT

Chronograph•New York, NY

10d

About The Position

Chronograph was founded to bring next-generation technology to private capital markets. Through our suite of cloud-based analytics and data management solutions, we help many of the world's largest and most sophisticated venture capital, private equity, and credit funds understand their investment performance in unprecedented detail, with over 258,000 private companies and 15,000 private capital funds monitored via our solution suite. At Chronograph, we get to go "behind the scenes" and work directly with investors who are driving some of the most impactful changes across high growth start-ups, global infrastructure and renewable energy, growth equity, and all other private capital strategies. The firm is backed by Sixth Street Growth, Summit Partners, Carlyle AlpInvest, and Nasdaq Inc., and has seen continuous rapid growth since its founding in 2016. Our client base today includes hundreds of investors and asset managers monitoring more than $5.9 trillion in invested capital with 8 of the 10 largest GPs and 5 of the 10 largest LPs using Chronograph. Bring your expertise to a highly collaborative, creative, and innovative team with a market-leading technology product suite. We hire technologists with a broad set of technical skills who are eager to solve a wide range of challenges. The thread that unites us at Chronograph is a focus on delivering great, secure products that drive value for our clients. We are looking for a Head of Information Security & IT to own Chronograph's security strategy, architecture, and execution as we continue to scale. This is a hands-on leadership role spanning security strategy, governance, technical execution, and external assurance. We expect you to continuously strengthen our information security program and certifications while remaining technically close enough to investigate issues, prototype solutions, and implement controls where appropriate. The security landscape is changing rapidly, particularly as AI expands both attacker capabilities and the attack surface of modern software. We want someone who follows emerging threats closely, continuously reassesses whether our security posture remains appropriate, and responds to credible new threats with urgency. Our ideal candidate has a strong sense of ownership, excellent judgment, and a bias toward action. You are equally comfortable defining security strategy, representing it with sophisticated clients and external stakeholders, and getting technically involved when that is the best way to move an issue forward.

Requirements

7+ years of information security experience, including meaningful hands-on technical experience and increasing ownership of security programs
Strong technical judgment and the ability to investigate problems, develop solutions, build proofs of concept, and implement controls when appropriate
Broad experience across cloud and application security, identity, vulnerability management, and detection and response
Experience owning or materially leading an information security program, including risk management, policies, controls, and security roadmap, leveraging frameworks such as NIST, CIS, or GDPR.
Experience leading SOC1, SOC 2, ISO 27001, or comparable security assurance and certification programs
Experience representing an organization's security controls, certifications, and risk posture with sophisticated enterprise customers and auditors
Strong security instincts and curiosity about emerging threats, including the rapidly evolving implications of AI
Strong executive communication skills and the ability to translate technical controls, risks, and security strategy into clear business language

Nice To Haves

Even if you do not meet all criteria, we would still encourage you to apply or get in touch! Chronograph offers an entrepreneurial environment where you will be able to proactively identify opportunities to develop and strengthen our team.

Responsibilities

Own Chronograph's information security program, strategy, architecture, and roadmap
Serve as Chronograph's senior security leader in strategic client, partner, and external engagements
Lead and mentor a small team of senior security, compliance, and IT practitioners
Continuously assess our security posture and prioritize pragmatic, high-impact improvements
Communicate material security risks, priorities, and tradeoffs clearly to executive leadership
Develop a deep understanding of the business, product, and infrastructure to make sound security decisions
Develop technical approaches for security initiatives, validate assumptions, and build proofs of concept where useful
Implement security controls directly where appropriate, while partnering with engineering and infrastructure teams on more complex efforts
Maintain sufficient technical depth across cloud, application architecture, identity, logging, and security tooling to investigate issues and guide implementation
Evaluate and configure security tooling and automation
Own the security posture and requirements for our cloud and application environments, partnering with infrastructure and engineering teams on implementation
Lead vulnerability management and threat modeling programs, hands-on where needed
Partner with engineering on secure development practices and application security architecture
Own and improve application security tooling, including SAST, SCA, DAST, SOAR, secrets detection, and infrastructure-as-code scanning
Prioritize vulnerabilities based on exploitability and business risk
Own security strategy for Chronograph's use of AI internally and within our products
Secure employee use of AI tools, agents, models, and integrations, including controls around sensitive data, third-party services, and agent permissions
Threat-model AI-enabled functionality, including prompt injection, data exfiltration, insecure tool use, excessive agency, and supply-chain risks
Track developments in offensive and defensive AI security and quickly assess their relevance to Chronograph
Evaluate AI-enabled security tooling and automation where it can improve our defensive capabilities
Own our detection and response stack, including SIEM, EDR, WAF, and DLP, as well as the automation routing alerts between them
Lead threat detection and incident response strategy, including security partner relationships
Set direction for corporate IT, identity, endpoint management, and employee technology, with the IT team owning day-to-day operations
Own Chronograph's SOC 1, SOC 2, ISO 27001, and broader security assurance strategy, with the GRC team managing day-to-day audit and evidence processes
Ensure our certifications, policies, risk management processes, and technical controls operate as a coherent information security program
Set direction for our annual risk assessment, risk register, policy lifecycle, and third-party risk program
Partner closely with compliance, sales, and customer teams on security due diligence, customer requirements, and strategic client engagements
Represent Chronograph's controls, certifications, and approach to risk with authority and credibility to customers, prospects, and auditors