Head of Security

Tonic AI

23h

About The Position

Tonic.ai is hiring a senior security leader to own its security program end to end. The role works directly with the founders and partners across engineering, DevOps, sales, and legal. It combines setting security strategy with hands-on execution, including maintaining the company’s security posture, supporting customer diligence and sales, and governing employee use of AI tools. The role will also help shape how the security function grows over time.

Requirements

Several years leading security at a B2B software company, with a record of building security programs rather than inheriting them.
Experience owning SOC 2 audits end to end and working knowledge of GDPR and HIPAA.
Hands-on experience securing AWS, GCP, and Azure environments, including reviewing and correcting IAM policies and misconfigurations.
Experience embedding security in the development lifecycle and running vulnerability management.
Ability to handle customer security questionnaires, participate in calls with customer CISOs, and work through contract redlines with legal.
Experience running corporate security and IT, including endpoint management, EDR, incident response, IAM, and vendor risk.
Uses AI tools and understands their risks, with the ability to create practical guardrails employees follow.
Self-directed, able to make sound, risk-based decisions without waiting for direction.
Clear communication with technical and executive audiences.

Nice To Haves

Experience at a data infrastructure, privacy, or AI company.
Experience selling into regulated industries such as healthcare and financial services.
Experience with ISO 27001, HITRUST, or FedRAMP.
Experience securing software customers deploy in their own environments, as well as SaaS.
Experience at an early-stage or fast-growing company.

Responsibilities

Own the SOC 2 program, including scoping, evidence collection, control remediation, and the auditor relationship.
Keep company practices aligned with GDPR, HIPAA, and security commitments in customer contracts.
Partner with engineering to embed security in the development lifecycle, from design review through release.
Run vulnerability management across code, dependencies, and infrastructure, including penetration tests and remediation tracking.
Secure and govern AWS, GCP, and Azure environments, including IAM, configuration, logging, and hardening, in partnership with DevOps and backend engineers.
Lead customer-facing security work, including security questionnaires, RFP responses, and calls with customers.
Work with legal on contract negotiations and security redlines.
Run corporate security and IT, including endpoint management, laptop hardening, EDR monitoring, and incident response.
Own identity and access management and vendor risk management across the company.
Set and maintain policies and guardrails for employee AI use, including LLM platforms, coding assistants, and MCP connectors, covering access controls, data handling, and AI-provider vendor reviews.
Keep AI-use policies current so employees can adopt new tools quickly and safely.
Learn the products, infrastructure, and current controls; take over the security questionnaire queue; and assess the company’s biggest risks.
Develop a prioritized security roadmap across product, cloud, and corporate security, and help determine future security hiring needs.