Manager, Security

Formation Bio•Boston, NY

1d•Hybrid

About The Position

Formation Bio is a technology- and AI-driven pharmaceutical company focused on accelerating drug development and clinical trials. The Manager, Security will lead the company’s security function, reporting to the Director of Technical Operations and working closely with the CTO’s organization. The role remains hands-on across data, cloud, application, and corporate security; leads incident response; and builds and manages a small security engineering team. The manager joins the on-call rotation and uses AI tools daily to build and maintain security work. Security at Formation Bio protects clinical and patient data, AI systems, and the applications used by company teams. The role partners with engineering and related teams to make security an engineering partnership that enables progress while managing risk. It owns a risk-based security roadmap, security operations and tooling, practical governance, audit readiness, vendor and budget management, and the hiring and development of security engineers. The position is hybrid, requiring three days per week in the office. Formation Bio prioritizes candidates in the New York City and Boston metro areas and may also consider candidates in the Research Triangle and San Francisco Bay Area. Applicants must reside in these locations or be willing to relocate. The total compensation range is $185,500–$232,000; individual compensation depends on role scope, location, skills, and experience. The company also offers equity, comprehensive benefits, and generous perks.

Requirements

At least 5 years of experience in security engineering or security operations, with hands-on depth in data, cloud, and application security.
Experience leading incident response through resolution and making independent severity decisions under pressure.
Ability to read and write code and partner with engineers on secure design, remediation, and pipeline security.
Uses AI tools daily and understands how to secure AI-enabled systems.
Hands-on experience with SIEM, EDR, vulnerability management, and security automation.
Experience owning security tooling, budgets, and vendor relationships.

Nice To Haves

Direct people-management experience, including providing feedback, supporting development, and hiring.
Experience with agentic identity and security, MCP integrations, or governance of citizen-built applications.
Experience in a regulated industry such as life sciences, healthcare, or fintech.
Familiarity with HIPAA, GxP, and 21 CFR Part 11.

Responsibilities

Lead incident response end to end, including triage, severity decisions, containment, recovery, stakeholder communication, post-incident reviews, and follow-through on corrective actions.
Join the on-call rotation; the Director of Technical Operations serves as the escalation contact.
Work hands-on across data, cloud (AWS and GCP), application, and corporate security, reviewing architecture, configurations, code, and pipelines with engineering teams and helping complete remediation.
Own data security for regulated clinical and patient data and data used by AI systems, including access, classification, handling, and sharing controls.
Secure the AI platform and agentic workflows, including agent and service identity, credentials and secrets, MCP connectors, tool permissions, and AI-agent guardrails.
Set guardrails and review paths for citizen-built applications while enabling builders to continue working.
Operate and tune SIEM, EDR, and vulnerability management, and maintain sustainable alerting and paging for the on-call team.
Use AI tools to build and maintain detection, triage, and security automation, applying code-level review and testing standards.
Verify controls through detection tests, tabletop exercises, and assessments, and confirm fixes before closing findings.
Develop a risk-based security roadmap and lead security projects from scoping through delivery.
Manage the security tooling and services budget, renewals, and vendor performance; report quarterly to the Director and CTO on security posture, material risks, and decisions needed.
Maintain lightweight, practical governance, including a risk register, policies, exceptions, and AI governance, with controls and automated evidence supporting GxP, HIPAA, and 21 CFR Part 11 obligations and routine audit readiness.
Partner as a technical peer with engineering, Enterprise AI, infrastructure, IT, and CSV, and drive security awareness using observed risks and incidents.
Hire, coach, and manage security engineers, setting clear expectations and documenting development plans and growth paths.
During the first 30 days, learn the environment and controls, join the on-call rotation, complete a cross-domain gap analysis, and agree on a prioritized roadmap with the Director.
By three months, baseline security operational metrics, tune alerting, deliver priority fixes, assign owners and timelines to material gaps, run a tabletop exercise and control verification tests, and establish communication, risk-tracking, and reporting cadences.
By six months, lead incidents and routine operational decisions independently, demonstrate improvements against operational baselines, sustain audit readiness, put guarded AI-assisted security automation into production, and ensure each direct report has clear expectations and a documented development plan.