[Hiring] Head of InfoSec @AIOS (YC W20/S21)

Role Description

As Head of Information Security & Systems at AIOS, your fundamental role is to build the secure foundation that allows us to scale globally without compromising patient trust, operational resilience, or speed.

• You’ll own cybersecurity and internal systems across the AIOS group, spanning our healthcare businesses, technology platforms, pharmacy infrastructure, and more.
• This includes security strategy, identity and access management, endpoint security, incident response, architecture, tooling, and overall security compliance.
• You’ll turn that strategy into a consistent, scalable operating model across our entities and geographies.
• You’ll set clear standards, strengthen controls, establish ownership across teams, and ensure risks are identified, prioritized, and actually resolved as the business grows.
• This is both a strategic and hands-on role.
• You’ll advise leadership on material risks while also diving in to investigate issues, improve controls, review architecture, implement tooling, and drive remediation across the business.
• Great performance in this role means we can move faster because our systems are secure, resilient, and scalable; teams understand their responsibilities; leadership has clear visibility into risk; and patients, employees, partners, and regulators can trust how we protect their data.

This is a full-time, fully remote role, and you’ll work async in the timezone of your choice — as long as you’re around until midday Pacific Time for calls as needed.

You’ll report directly to Joey Gracek, Head of Business Operations.

You’ll also work most closely with:

• Gzim Helshani (VP Engineering)
• Jordan Pellikan (Chief of Staff)

Qualifications

• 5+ years experience leading cybersecurity, information security, or security engineering in a complex, fast-growing organization and have owned outcomes.
• You can operate credibly across identity and access management, endpoint security, cloud infrastructure, application security, incident response, vulnerability management, and corporate systems.
• You have built or significantly improved a security program, including its roadmap, controls, policies, tooling, processes, and operating model.
• You are comfortable entering an environment that is still evolving, identifying what needs to be done, and driving it through to completion with limited structure.
• You can identify the risks that genuinely matter, explain them clearly, and implement proportionate controls without creating unnecessary friction or slowing the business down.
• You have managed security incidents or high-severity technical issues and can lead calmly through investigation, containment, communication, recovery, and remediation.
• You can work effectively with engineering, operations, legal, compliance, people, clinical, and executive teams, even when you do not directly manage the people responsible for implementation.
• You have worked in an environment handling highly sensitive customer, patient, financial, employee, or similarly regulated data.

Requirements

• Healthcare Experience: You have worked in digital health, telemedicine, pharmacy, clinical operations, health insurance, or another healthcare environment.
• International Experience: You have owned security across multiple countries, legal entities, or business units, particularly across the US, UK, and Europe.
• Compliance: You have supported or led programs involving HIPAA, GDPR, UK GDPR, SOC 2, ISO 27001, or similar security and privacy frameworks.
• IT Ownership: You have managed identity platforms, device management, endpoint protection, productivity systems, employee lifecycle processes, and internal support operations.
• Scaling: You have hired, developed, or managed security and systems professionals and know what capabilities should remain internal versus outsourced.

Benefits

• Compensation: $150-250k, including equity
• Healthcare: comprehensive medical insurance (if appropriate)
• Vacation: PTO with a yearly minimum (≥2wks/yr + local national holidays)
• Remote: our team is fully distributed across the world and functions fully remotely
• Personal development: budget for books, courses, coaching ($1200/yr)
• Personal wellness: budget for gym, health apps ($1200/yr)
• Coaching: free biweekly health coaching
• Equipment: Macbook & work-from-home equipment provided as needed

Company Description

AIOS is building the world’s first full-stack AI doctor. We’re at $350M ARR, growing from $10M/yr 12 months ago. We’re the world’s fastest growing AI doctor.

• We’re faithfully serving >150k/mo patients via Bolt Pharmacy, our main UK brand.
• We’re profitable.
• Our strategy exists at the intersection of two strong theses:
• The AI doctor that wins will get to escape velocity using GLP-1s, the fastest growing consumer product in history.
• The $2T European healthcare market is overlooked by the most talented builders.

Our master plan:

• Step 0 → $100M/yr by end of 2025: We went from $10M to $100M in 6 months serving the UK GLP-1 market.
• Step 1 → $1B ARR by end of 2026: Over the last 12 months we've grown from 3k to 150k UK active GLP-1 patients. We’ll continue this growth curve to hit $1B ARR.
• Step 2 → $10B ARR by end of 2028: Blitzscale Europe. We’ll be Europe’s largest GLP-1 provider.
• Step 3 → $100B/yr by end of 2031: Get regulatory approval across Europe for our Full Autonomous Prescribing (FAP) system. Win contracts at scale with European payers to mass replace human labor. We’ll be the dominant full-stack AI doctor in Europe.
• Step 4 → $1T/yr by end of 2035: With one line of code and zero human time, you can use AIOS to treat any patient globally with any medication.

In so doing, we’ll become the world’s first trillion-dollar healthcare company.

We’re a young, founder-led company. This is still Day 1 and all our work is ahead of us.