Head of Security

Helius

6d•Remote

About The Position

Helius is hiring its first Head of Security to lead security hands-on across the company’s engineering platform and build a security team as the company grows. The role owns security across infrastructure, cloud, and production systems, with a mandate to establish a strong security posture and lead incident response. The Head of Security will help leadership understand and manage risk and will have authority to make clear risk decisions while protecting critical infrastructure at scale. The role reports to the COO and Head of Engineering. It also leads the compliance roadmap, responds to customer security reviews, partners with engineering to incorporate security into development and delivery, and communicates risk to executives, engineers, and customers. The position is part of a fully remote, async-friendly team.

Requirements

At least 8 years of experience in security, including securing high-availability, internet-facing infrastructure at scale.
Strong engineering skills, including the ability to read and write code and investigate systems hands-on.
Deep expertise in cloud security, bare metal, and production environments.
Hands-on experience with detection and response, including leading through a real security incident.
Experience building a security program or significantly scaling a security function.
Experience securing developer products, APIs, or platforms.
Strong grasp of secrets and key management.
Ability to move fast, iterate, and make sound decisions under pressure.
Pragmatic, high-ownership approach, including willingness to do the work without a large team or established tooling.
Clear communication skills and ability to partner with engineers and say no without becoming a blocker.
Comfort working in a fully remote, async-friendly team.

Nice To Haves

Experience leading a SOC 2 or similar audit.
Prior security leadership at a high-growth startup.

Responsibilities

Set security direction and own execution across infrastructure, cloud, and production systems.
Own incident response end to end, including detection, response, runbooks, on-call readiness, and regular tabletop exercises.
Establish security across the engineering platform, including identity and access management, secrets and key management, network segmentation, logging, monitoring, and detection.
Review and manage third-party and supply-chain risk.
Partner with engineering to embed security into development and delivery without becoming a bottleneck.
Lead the compliance roadmap and respond to customer security reviews.
Hire, develop, and grow the security team as the company scales.
Own the security strategy and roadmap, and maintain the threat model and risk register while prioritizing based on real risk.
Communicate risk clearly with executives, engineers, and customers.