[Hiring] Head of Security @Tremendous

Role Description

You'll be our first Head of Security. There's already a real foundation here—bug bounty, pen tests, automated code and configuration scanning on the production and code side, phishing simulations on the people side. You’ll add to it across:

• Access and identity
• SecOps and monitoring
• Incident response
• Vendor security
• Employee security practices
• Policy

You'll own the whole posture. This is a player-coach role. Early on, you'll do the scoping and the hands-on work yourself; this is not a role where you direct from above. As the work demands it, we're fully prepared to build a team here—and we're looking to you to define what that team should be and when.

You'll report to the VP of Engineering, Tremendous' most senior technical leader. We've deliberately placed security with Engineering so you're set up to drive real implementation fast—embedded with the people whose work you're securing, not siloed in a compliance function. As the security function matures, we'll revisit this.

What you'll do:

• Own Tremendous' security posture end-to-end, partnering with our engineering team on production infrastructure and code security.
• Assess where we have gaps, prioritize them, and tackle our highest-leverage gaps first.
• Treat incident response as core, not afterthought.
• Drive security as a cultural shift across the company—introducing controls incrementally, working with teams rather than over them.
• Lead our AI-security posture.
• Define when and how to staff up the security function, and hire your own team.

Qualifications

• Real, hands-on security experience at a company that scaled—ideally as an early security hire who grew with the business through high growth.
• Deep experience in at least one core security domain—product/production security, security operations, or access/identity and policy—with enough range to reason across the others.
• An engineer's mindset; you reach for code to solve problems and can read our codebase and understand our infrastructure (Ruby on Rails; TypeScript + React; PostgreSQL; Google Cloud).
• Judgment over checklists; you can explain the actual risk of a given decision.
• Bedside manner; you drive hard change by bringing the team around to your point of view.
• Experience building or co-building a small security team is a plus.
• Fintech, payments, or regulated-industry experience is a plus.

Benefits

• You define the function.
• First security leader, with the budget for the required tools and team.
• A real mandate; the push for this hire comes straight from the founders.
• We invest in your tools; everyone has a $5k/month budget for AI tools.
• Competitive pay and equity; base salary $250,000–$330,000, plus meaningful equity.
• Fully remote; work from anywhere in the Americas.
• Great culture; read more about how we work in our public handbook.