Head of Security

About the role

Tonic.ai has been de-identifying sensitive data since 2018, and hundreds of enterprises use our products, among them eBay, UnitedHealth Group, Qualcomm, Commonwealth Bank, and Mercor. Our customers hand us some of the most sensitive data they have: production databases, patient and financial records, and increasingly the email, chat, documents and code that AI labs want to train on.

That makes security part of what we sell, not just how we operate. Every deal runs through a security review, every customer asks how their data is protected, and the AI tools our own team uses every day raise new questions faster than most policies can keep up. We're looking for a Head of Security who can own all of it.

Why This Role, Why Now

Our customers are getting bigger and more regulated, and our products now sit in the middle of AI training-data deals where the buyer, the seller and their lawyers all want proof that the data was handled safely. The bar for our own security program is rising with them. What keeps deals moving is a security leader who can pass the audit, answer the questionnaire, get on the call with a customer's CISO, and keep our own house in order at the same time.

That's this job. You'll be Tonic's senior security leader, working directly with our founders, engineering, DevOps, sales and legal. You'll own the program end to end, setting the strategy and doing much of the hands-on work yourself.

What You'll Do

Own our SOC 2 program end to end: scoping, evidence collection, control remediation, and the auditor relationship.

Keep our practices aligned with GDPR, HIPAA, and the security commitments in our customer contracts.

Partner with engineering to build security into the development lifecycle, from design review through release, so products ship securely and on time.

Run vulnerability management across our code, dependencies, and infrastructure, including pen tests and remediation tracking.

Secure and govern our AWS, GCP, and Azure environments (IAM, configuration, logging, hardening), working closely with DevOps and backend engineers.

Act as the customer-facing security expert. Own security questionnaires and RFP responses, and join sales calls when a customer wants to go deep.

Work with legal on contract negotiations and security redlines.

Run corporate security and IT: endpoint management and laptop hardening, EDR monitoring, and incident response.

Own identity and access management and vendor risk management across the company.

Set and maintain policies and guardrails for employee AI use, including LLM platforms, coding assistants, and MCP connectors, covering access controls, data handling, and vendor review of AI providers.

Keep those AI policies current as the landscape moves, so the team can adopt new tools quickly and safely.

What We're Looking For

Several years leading security at a B2B software company, with a record of building programs rather than inheriting them.

SOC 2 audits owned end to end, plus working knowledge of GDPR and HIPAA.

Hands-on experience securing AWS, GCP, and Azure. You can read an IAM policy, spot a misconfiguration, and fix it with the engineer who owns it.

Experience embedding security in the development lifecycle and running vulnerability management without becoming the team that slows everything down.

Comfort in front of customers. You can answer a 300-question security questionnaire, hold your own on a call with a customer's CISO, and work through redlines with legal.

Experience running corporate security and IT: endpoint management, EDR, incident response, IAM, and vendor risk.

AI-native workflow. You use AI tools yourself, understand where they create real risk, and can write guardrails that people actually follow.

Self-direction. You'll be the security leader, and you'll need to make sound, risk-based calls without waiting for someone to tell you what to do.

Clear communication with very different audiences, from an engineer debugging a finding to an executive weighing a tradeoff.

Nice to Haves

Experience at a data infrastructure, privacy, or AI company.

Experience selling into regulated industries such as healthcare and financial services.

Experience with ISO 27001, HITRUST, or FedRAMP.

Experience securing software that customers deploy in their own environments, alongside SaaS.

Experience at an early-stage or fast-growing company.

What Success Looks Like

In your first month, you'll learn our products, infrastructure, and current controls, take over the security questionnaire queue, and build a clear picture of our biggest risks. By the end of your first quarter, you'll own the SOC 2 program and auditor relationship, have a prioritized roadmap across product, cloud, and corporate security, and have AI-use policies in place that the team actually follows. After that, you'll help shape how security grows at Tonic, including whether and when we hire next.

Why Join

You'll own security at a company where security is part of the product, not a back-office function.

You'll work directly with our founders, with a real say in how the company handles risk and makes commitments to customers.

You'll get close to the AI training-data market and help set the bar for how sensitive data should be handled in it.

You'll shape AI governance in real time, at a company whose own business is making data safe for AI.

Competitive compensation and equity.

Benefits We Offer

Competitive salary and equity

Unlimited paid time off

401k plan with employer contribution

Medical, dental, and vision insurance

Generous parental leave policy

Remote-friendly work environment

Tonic.ai is an equal opportunity employer. We're building a team that reflects the diversity of our users and the problems they're trying to solve.

Posting text as published by Tonic AI.

The evidence behind this listing

Workplace

Remote Employer field

Seniority

leadership From the job title

Employment type

full time

Location as listed

Remote

Pay and work authorization

Stated pay

Not stated

Visa sponsorship

Not stated

Security clearance

Not established

Citizenship

Not established