[Hiring] Head of Security & Compliance @Finch AI

Role Description

We are seeking a hands-on Head of Security & Compliance to own and operate our company-wide compliance program. This is an executive-facing operating role—not a policy-only or advisory position. You will administer our Microsoft 365 and Entra environment, maintain audit-ready evidence, respond to customer security reviews, and brief leadership on compliance posture and risk.

• Sustain CMMC Level 2 and maintain accurate SSP, POA&M, and SPRS documentation.
• Administer Microsoft 365, Entra ID, Purview, Defender, Exchange Online, SharePoint, and Teams security controls.
• Govern source-code access, branch protection, secrets, CI/CD pipelines, build integrity, and software supply-chain evidence.
• Define and maintain CUI, personnel-access, and segregated-development boundaries.
• Build and operate security awareness, insider-threat, and incident-response programs.
• Own customer security assessments and DFARS 252.204-7012 obligations.
• Establish a practical AI governance and assurance program.
• Assess AWS security controls and evidence without serving as the AWS operator.
• Help shape future FedRAMP or GovRAMP authorization efforts as customer demand develops.
• Brief executives, the board, customers, and external assessors.

Qualifications

• 7+ years in federal or defense-industrial security, compliance, governance, or ISSM-type roles.
• Direct experience implementing and sustaining NIST SP 800-171, CMMC, an ATO, FedRAMP continuous monitoring, or a comparable authorization.
• Hands-on authorship and maintenance of SSPs, POA&Ms, and audit evidence.
• Working knowledge of DFARS, CUI handling, and DoD incident-reporting requirements.
• Production administration experience with Microsoft 365 and Entra ID.
• Experience applying security controls to source control, CI/CD pipelines, secrets, and software-development environments.
• Ability to evaluate technical cloud controls and determine whether the documented posture matches reality.
• Strong executive communication and defensible technical writing skills.
• Experience with FedRAMP or GovRAMP, export controls, insider-threat programs, AI governance, AWS, research security, GCC High, or relevant certifications is preferred.

Company Description

Finch AI is a growing GovTech software company building research-security and intelligence products for federal agencies and universities. We operate with a lean, highly technical team where security and compliance are essential to our ability to serve customers and grow.

Finch AI turns complex text into accurate, trusted, real-time intelligence that helps organizations understand risk and act decisively. Our platform combines entity intelligence, knowledge graphs, agentic AI, and deep domain expertise to support critical missions.

Our remote-first team of engineers, analysts, data scientists, and mission experts values curiosity, ownership, collaboration, and integrity. We seek people who enjoy solving difficult problems and building technology with real-world impact.

Finch AI is an equal opportunity employer. Reasonable accommodations are available during the hiring process by contacting [email protected].