Manager, Security

Formation Bio•Boston, MA

2d•$185,500 - $232,000•Hybrid

About The Position

Formation Bio is a technology- and AI-driven pharmaceutical company focused on accelerating drug development and clinical trials. The Manager, Security will lead security, report to the Director of Technical Operations, and work closely with the CTO’s organization. The role combines hands-on security engineering across data, cloud, application, and corporate security with incident response leadership and management of a small security engineering team. The position joins the on-call rotation and uses AI tools daily to build and maintain security work. Security at Formation Bio protects clinical and patient data, AI systems, and the applications used by its teams. The company describes security as an engineering partnership that enables its AI-native organization rather than acting as a gate. The role will establish practical governance and controls that support GxP, HIPAA, and 21 CFR Part 11 obligations, while keeping audit readiness routine.

Requirements

At least 5 years of experience in security engineering or security operations, with hands-on depth in data, cloud, and application security.
Experience leading incident response to resolution and making independent severity decisions under pressure.
Ability to read and write code and experience partnering with engineers on secure design, remediation, and pipeline security.
Uses AI tools daily and understands how to secure AI-enabled systems.
Hands-on experience with SIEM, EDR, vulnerability management, and security automation.
Experience owning security tooling, budgets, and vendor relationships.

Nice To Haves

Direct people-management experience, including feedback, employee development, and hiring.
Experience with agentic identity and security, MCP integrations, or governance of citizen-built applications.
Regulated-industry experience, such as life sciences, healthcare, or fintech.
Familiarity with HIPAA, GxP, and 21 CFR Part 11.

Responsibilities

Lead incident response from triage and severity decisions through containment, recovery, stakeholder communication, post-incident reviews, and closure of corrective actions; participate in the on-call rotation.
Work hands-on across data, cloud (AWS and GCP), application, and corporate security, reviewing architecture, configuration, code, and pipelines with engineering teams and helping complete fixes.
Own security for regulated clinical and patient data and data used by AI systems, including access, classification, handling, and sharing controls.
Secure the AI platform and agentic workflows, including agent and service identity, credentials and secrets, MCP connectors, tool permissions, and AI-agent guardrails.
Set guardrails and review paths for citizen-built applications.
Operate and tune SIEM, EDR, and vulnerability management, and maintain sustainable alerting and paging for the on-call team.
Use AI tools to build and maintain detection, triage, and security automation, applying code-level review and testing standards.
Verify controls through detection tests, tabletop exercises, and assessments, and confirm fixes before closing findings.
Develop and run a risk-based security roadmap, leading security projects from scoping through delivery.
Manage the security tooling and services budget, renewals, and vendor performance; report quarterly to the Director and CTO on security posture, material risks, and decisions needed.
Maintain practical governance, including a risk register, policies, exceptions, and AI governance, with controls and automated evidence supporting GxP, HIPAA, and 21 CFR Part 11 obligations.
Partner technically with engineering, Enterprise AI, infrastructure, IT, and CSV, and drive security awareness using observed risks and incidents.
Hire, coach, and manage security engineers, setting clear expectations and documenting development plans and growth paths.