[Hiring] Head of Security @Tonic AI

Role Description

Tonic.ai is looking for a Head of Security who can own all aspects of security as the company grows and faces increasing regulatory demands.

• Own our SOC 2 program end to end: scoping, evidence collection, control remediation, and the auditor relationship.
• Keep our practices aligned with GDPR, HIPAA, and the security commitments in our customer contracts.
• Partner with engineering to build security into the development lifecycle, from design review through release, so products ship securely and on time.
• Run vulnerability management across our code, dependencies, and infrastructure, including pen tests and remediation tracking.
• Secure and govern our AWS, GCP, and Azure environments (IAM, configuration, logging, hardening), working closely with DevOps and backend engineers.
• Act as the customer-facing security expert. Own security questionnaires and RFP responses, and join sales calls when a customer wants to go deep.
• Work with legal on contract negotiations and security redlines.
• Run corporate security and IT: endpoint management and laptop hardening, EDR monitoring, and incident response.
• Own identity and access management and vendor risk management across the company.
• Set and maintain policies and guardrails for employee AI use, including LLM platforms, coding assistants, and MCP connectors, covering access controls, data handling, and vendor review of AI providers.
• Keep those AI policies current as the landscape moves, so the team can adopt new tools quickly and safely.

Qualifications

• Several years leading security at a B2B software company, with a record of building programs rather than inheriting them.
• SOC 2 audits owned end to end, plus working knowledge of GDPR and HIPAA.
• Hands-on experience securing AWS, GCP, and Azure.
• Experience embedding security in the development lifecycle and running vulnerability management without becoming the team that slows everything down.
• Comfort in front of customers; able to answer a 300-question security questionnaire and hold your own on a call with a customer's CISO.
• Experience running corporate security and IT: endpoint management, EDR, incident response, IAM, and vendor risk.
• AI-native workflow; understanding where AI tools create real risk and writing guardrails that people actually follow.
• Self-direction; able to make sound, risk-based calls without waiting for direction.
• Clear communication with very different audiences, from an engineer debugging a finding to an executive weighing a tradeoff.

Nice to Haves

• Experience at a data infrastructure, privacy, or AI company.
• Experience selling into regulated industries such as healthcare and financial services.
• Experience with ISO 27001, HITRUST, or FedRAMP.
• Experience securing software that customers deploy in their own environments, alongside SaaS.
• Experience at an early-stage or fast-growing company.

What Success Looks Like

• In your first month, learn our products, infrastructure, and current controls, take over the security questionnaire queue, and build a clear picture of our biggest risks.
• By the end of your first quarter, own the SOC 2 program and auditor relationship, have a prioritized roadmap across product, cloud, and corporate security, and have AI-use policies in place that the team actually follows.
• Help shape how security grows at Tonic, including whether and when we hire next.

Benefits

• Competitive salary and equity
• Unlimited paid time off
• 401k plan with employer contribution
• Medical, dental, and vision insurance
• Generous parental leave policy
• Remote-friendly work environment