Information Security Lead

Alloy Therapeutics • Waltham, MA

1d • $150,000 - $200,000 • Remote

About The Position

The Company
We are Alloy Therapeutics—a biotechnology ecosystem company empowering the global scientific community to make better medicines together. Through a community of partners, we democratize access to pre-competitive tools, technologies, services, and company creation capabilities that are foundational for discovering and developing therapeutic biologics. The company facilitates affordable, non-exclusive access to the entire drug discovery community from academic scientists, small and medium biotech, to the largest biopharma. At Alloy, we believe our industry should compete on getting the best drugs to patients as quickly as possible, not exclusive access to the best platforms. As a reflection of our relentless commitment to the scientific community, we reinvest 100% of our revenue in innovation and access to innovation. MAY THE BEST DRUG WIN.
Alloy has evolved from a startup into a global biotechnology infrastructure company operating 11 divisions across 5 research sites in 4 countries on 3 continents. Our model - Integrated Independence - combines centralized capabilities with entrepreneurial operating divisions. Successful members thrive in our shared culture of accountability, deliberate trust, and open communication. As a team we aspire to work together to exceed expectations and collectively contribute across the global organization to always maintain our nimble, startup culture.
At Alloy, we have an ethos of “Mentorship-By-Apprenticeship” in all of our positions. We strive to have workers in the office when needed to interact organically and face-to-face. Of course, as a lab-based operation, our cells and animals grow 7 days a week, 365 days per year. We respect and value our colleagues for their hard work that requires them to be in the lab every day. We ask our people who have more flexible accommodations, like this position, to appreciate their colleagues who have less flexibility. We are all one team!
The Team
The IT function at Alloy Therapeutics sits at the nerve center of our bold scientific mission to enable the researchers, scientists, and AI experts to set the standard for what's possible in collaborating to discover and develop new medicine. Proprietary new medicine comes from proprietary insights and proprietary data that are closely guarded and protected by our partners as their core economic differentiator to make their business work. As such, protecting and federating these data is one of the most critical aspects of our business.
Over the last 10 years, Alloy has reinvented the paradigm of the biotech “Contract Research Organization” (CRO) by creating a true biotech infrastructure company we call a “Product Development Organization” (PDO). As the world’s first PDO, Alloy is defining what it means to work closely and longitudinally with our partners to discover and develop new therapeutics for their drug pipeline. This is a true partnership model with shared risk and economics requiring trust and data protection throughout the long life of the partnership.
We operate with the pace and ambition of a startup and the rigor of a company where technology failures have real consequences. Data and Information Security is a core enabler of the trust that lets us work with the world's leading pharmaceutical partners, handle sensitive research data responsibly, and protect the proprietary science that defines our competitive advantage. We are building our security program in earnest and need someone who can do both: design and implement technical controls from the ground up, and write the governance frameworks and policies that make those controls auditable and defensible.
The Role
As Information Security Lead, you will own Alloy's security program in its entirety — building on a strong foundation and shaping our IT team’s motto of responsible innovation. This is a rare role that offers breadth of scope: you will be equally responsible for hands-on technical work (configuring IAM controls, participating in system architecture, managing endpoint security and patching, running vulnerability management) and for the governance work that sits alongside it (writing policies, maintaining compliance documentation, and satisfying the increasingly rigorous security requirements of our enterprise partners). You will be the primary security practitioner at Alloy — the person who gets called when something goes wrong and the person who built the system that catches it before it does.
This role will report to the Director, Information Technology and will work in close partnership with the broader IT team and the AI and research Divisions in a fast-moving, AI-forward environment.

Requirements

• Significant breadth across both technical security work and governance. You are equally comfortable architecting a backup solution or configuring IAM policies as you are writing an incident response plan or preparing evidence for an audit
• Hands-on experience with cloud security across Google Workspace and AWS (or GCP/Azure equivalent), including IAM design, cloud storage security, and logging and monitoring configuration
• Experience securing proprietary scientific or research data at massive scale. Segmenting and federating multi-petabyte environments, high-throughput research and model-training pipelines, and the data-protection engineering that protecting irreplaceable datasets demands
• Experience defending against advanced and nation-state-level threat actors, and supporting sovereign, government, or other high-assurance programs with elevated security and data-residency requirements
• Experience implementing MFA programs including FIDO2/hardware key standards (e.g., YubiKey) and SSO/SCIM provisioning across a SaaS environment
• Demonstrated experience with backup architecture design, including immutable and geo-redundant backup solutions, and with running and documenting restore tests
• Familiarity with compliance frameworks including SOC 2 Type 2 and/or ISO 27001 — ideally you have worked through an audit or certification process and understand what evidence-ready looks like in practice
• Experience writing security policies and documentation that can withstand external scrutiny (AUPs, IRPs, BCP/DR plans, vulnerability management programs) as living operational documents
• Comfortable operating as the primary security practitioner in a lean environment where you are self-directed, able to prioritize across competing demands, and effective at coordinating with Legal, Finance, and external vendors without bureaucratic supporting team

Nice To Haves

• Biotech, life sciences, or regulated industry experience strongly preferred; experience with pharmaceutical partner security requirements a plus

Responsibilities

• Incident Response & Business Continuity: You refine and own Alloy's Incident Response Plan and Business Continuity / Disaster Recovery plan as live operational playbooks that you maintain, test annually, and can execute under pressure. You establish clear partner-notification SLAs and ensure our detection and response tooling is wired to the right workflows.
• Vulnerability & Patch Management: You run a structured vulnerability management program with defined remediation SLAs (including tight timelines for critical-severity findings), integrate CVE and CSIRT advisory feeds into a regular review cadence, and work directly with IT to ensure patch coverage across endpoints and internet-exposed services. You also coordinate annual penetration testing with an external firm and track findings through to closure.
• Policy, Governance & Compliance: You maintain Alloy's information security policy landscape by maintaining and continuously improving a coherent, indexed Information Security Program that can survive an external audit. You own our SOC 2 type designations, manage the evidence collection and audit readiness work, and ensure we can satisfy the increasingly detailed security questionnaires and contractual requirements that come with working alongside major pharmaceutical partners.
• Identity, Access & Endpoint Hardening: You design and implement IAM controls that enforce least-privilege across cloud, SaaS, and on-prem systems including standardizing MFA (including FIDO2/hardware key deployment for high-assurance scenarios), building access registries, automating provisioning and de-provisioning, and closing gaps in privilege management. You also own endpoint security configuration across our fleet, ensuring encryption, patching cadence, and EDR coverage are consistently enforced.
• Data Protection & Security Posture: You own Alloy’s approach to protecting and ensuring proper federation of proprietary scientific data at massive scale across its full lifecycle. You are responsible for classifying and safeguarding multi-petabyte research, model-training, and partner-derived datasets. You define handling and access requirements and ensure controls are in place wherever that data lives. You treat data protection as a first-class engineering discipline: encryption in transit and at rest, key management, exfiltration detection, and tamper-evident controls operating across high-throughput, large-scale data pipelines. You ensure our backup and recovery capabilities meet continue to meet the evolving partner requirements (including immutable, geo-redundant copies of critical data), maintain a data retention and deletion process that can be demonstrated to external auditors, and own data residency and sovereignty controls for high-assurance and government-aligned projects.
• Detection, Monitoring & Threat Response: You maintain visibility across Alloy’s environment through logging, alerting, and monitoring tooling, and you own incident classification and response when things go wrong. You design detection and response plans against advanced, persistent, and nation-state-level threat actors by integrating threat intelligence, building anomaly detection across large-scale data movement, and maintaining rapid containment playbooks for sophisticated intrusion attempts. You assess whether our current tooling provides sufficient coverage or whether additional capabilities are warranted.
• AI & Emerging Technology Security: You work closely with Alloy's AI teams to ensure our AI-forward environment is secure, including assessing data flows through AI tooling, managing shadow-AI risk, and building controls that let the organization adopt new capabilities without exposing partner or research data. You help ensure our AI usage policies are nimble and operationalized, not just documented.
• Application & SaaS Security: You serve as the security voice in software and tooling decisions across the organization as you evaluate new SaaS applications, advise business teams on secure configuration and data-handling practices, manage vendor security reviews, and ensure that the software landscape Alloy depends on doesn't introduce unacceptable risk. You maintain an application inventory with associated risk ratings and own the process for assessing and onboarding new tools.
• Sovereign & High-Assurance Program Security: You design and operate the elevated controls required for sovereign and government-aligned engagements carrying national-security sensitivity with strict data residency and segregation, compartmentalized access, enhanced personnel and supply-chain assurance, and defenses calibrated to nation-state threat actors. You serve as the security liaison for government and sovereign partners and ensure Alloy can meet the heightened requirements that come with sovereign-level work.

Benefits

• Competitive base and equity compensation commensurate with level of experience and independence
• 401(k) company match
• Generous personal and family medical, dental and vision benefits with 100% of premiums and deductibles covered
• Company-paid disability (STD, LTD) and life insurance
• Paid parental leave
• Family planning support up to $45,000 (e.g., IVF/PGT, adoption, surrogacy, egg retrieval)
• Unlimited PTO (paid time off) and flexible schedules
• Annual stipend for continuing education with commitment to your career through individualized professional development plan
• Wellness and Extensive Employee Assistance Program (EAP) including resources for mental wellness

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed