[Hiring] Information Security Lead @Alloy Therapeutics

Role Description

As Information Security Lead, you will own Alloy's security program in its entirety — building on a strong foundation and shaping our IT team’s motto of responsible innovation. This is a rare role that offers breadth of scope:

• Hands-on technical work (configuring IAM controls, participating in system architecture, managing endpoint security and patching, running vulnerability management).
• Governance work (writing policies, maintaining compliance documentation, satisfying security requirements of enterprise partners).
• Primary security practitioner at Alloy — the person who gets called when something goes wrong and the person who built the system that catches it before it does.

This role will report to the Director, Information Technology and will work in close partnership with the broader IT team and the AI and research Divisions in a fast-moving, AI-forward environment.

Key Responsibilities

• Incident Response & Business Continuity: Refine and own Alloy's Incident Response Plan and Business Continuity / Disaster Recovery plan as live operational playbooks.
• Vulnerability & Patch Management: Run a structured vulnerability management program with defined remediation SLAs.
• Policy, Governance & Compliance: Maintain Alloy's information security policy landscape and manage SOC 2 type designations.
• Identity, Access & Endpoint Hardening: Design and implement IAM controls that enforce least-privilege across systems.
• Data Protection & Security Posture: Own Alloy’s approach to protecting and ensuring proper federation of proprietary scientific data.
• Detection, Monitoring & Threat Response: Maintain visibility across Alloy’s environment and own incident classification and response.
• AI & Emerging Technology Security: Work closely with Alloy's AI teams to ensure security in an AI-forward environment.
• Application & SaaS Security: Serve as the security voice in software and tooling decisions across the organization.
• Sovereign & High-Assurance Program Security: Design and operate elevated controls for sovereign and government-aligned engagements.

Qualifications

• Significant breadth across both technical security work and governance.
• Hands-on experience with cloud security across Google Workspace and AWS (or GCP/Azure equivalent).
• Experience securing proprietary scientific or research data at massive scale.
• Experience defending against advanced and nation-state-level threat actors.
• Experience implementing MFA programs including FIDO2/hardware key standards.
• Demonstrated experience with backup architecture design.
• Familiarity with compliance frameworks including SOC 2 Type 2 and/or ISO 27001.
• Experience writing security policies and documentation that can withstand external scrutiny.
• Comfortable operating as the primary security practitioner in a lean environment.
• Biotech, life sciences, or regulated industry experience strongly preferred.

Benefits

• Competitive base and equity compensation commensurate with level of experience and independence.
• 401(k) company match.
• Generous personal and family medical, dental and vision benefits with 100% of premiums and deductibles covered.
• Company-paid disability (STD, LTD) and life insurance.
• Paid parental leave.
• Family planning support up to $45,000.
• Unlimited PTO (paid time off) and flexible schedules.
• Annual stipend for continuing education.
• Wellness and Extensive Employee Assistance Program (EAP).