Head of Security

Tonic.ai

. Own Tonic's SOC 2 program end to end, including scoping, evidence collection, control remediation, and auditor relationship .

Posted 11/9/2026full-timeRemote • United StatesLeadWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in managing SOC 2 programs, ensuring compliance with GDPR and HIPAA, and integrating security into the software development lifecycle. Proficient in vulnerability management, cloud security across AWS, GCP, and Azure, and maintaining corporate security and IT operations.

Highest-signal resume keywords

SOC 2 Program ManagementCloud Security (AWS, GCP, Azure)Vulnerability ManagementCustomer-Facing Security ExpertiseIdentity And Access Management

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

SOC 2 AuditsVulnerability ManagementIAM Policy ReviewSecurity Integration In Development LifecycleEndpoint ManagementIncident ResponseAI Security GuardrailsPenetration TestingControl RemediationSecurity Roadmap Development

Soft Skills

Clear CommunicationIndependent Decision-MakingCollaboration With Engineers

Tools & Technologies

AWSGCPAzureEDR MonitoringAI Tools

Certifications & Qualifications

ISO 27001HITRUSTFedRAMP

Industry Keywords

B2B SoftwareData InfrastructurePrivacyRegulated Industries

Tech Stack

Tools & technologies

AWSAzureGoogle Cloud Platform

About the role

Key responsibilities & impact

Own Tonic's SOC 2 program end to end, including scoping, evidence collection, control remediation, and auditor relationship
Maintain alignment with GDPR, HIPAA, and customer-contract security commitments
Partner with engineering to integrate security into the development lifecycle from design review through release
Run vulnerability management across code, dependencies, and infrastructure, including penetration testing and remediation tracking
Secure and govern AWS, GCP, and Azure environments, including IAM, configuration, logging, and hardening
Serve as the customer-facing security expert and own security questionnaires and RFP responses
Join sales calls involving detailed customer security discussions
Work with legal on contract negotiations and security redlines
Run corporate security and IT, including endpoint management, laptop hardening, EDR monitoring, and incident response
Own identity and access management and vendor risk management
Establish and maintain employee AI-use policies and guardrails covering LLM platforms, coding assistants, MCP connectors, access controls, data handling, and AI-provider review
Keep AI policies current as the security landscape evolves
Learn products, infrastructure, and controls; take over the security questionnaire queue; and assess major risks during the first month
Own the SOC 2 program and auditor relationship, create a prioritized security roadmap, and implement effective AI-use policies during the first quarter
Help determine how Tonic's security function should grow and when to hire additional staff

Requirements

What you’ll need

Several years leading security at a B2B software company, with a record of building programs rather than inheriting them
SOC 2 audits owned end to end, plus working knowledge of GDPR and HIPAA
Hands-on experience securing AWS, GCP, and Azure
Ability to read IAM policies, identify misconfigurations, and remediate them with engineers
Experience embedding security in the development lifecycle
Experience running vulnerability management
Customer-facing experience, including security questionnaires, CISO calls, and legal redlines
Experience running corporate security and IT, including endpoint management, EDR, incident response, IAM, and vendor risk
Experience using AI tools and creating practical AI security guardrails
Ability to make independent, risk-based decisions
Clear communication with engineers and executives
Experience at a data infrastructure, privacy, or AI company is a plus
Experience selling into regulated industries is a plus
Experience with ISO 27001, HITRUST, or FedRAMP is a plus
Experience securing customer-deployed software alongside SaaS is a plus
Experience at an early-stage or fast-growing company is a plus

Benefits

Comp & perks

Competitive salary and equity
Unlimited paid time off
401k plan with employer contribution
Medical, dental, and vision insurance
Generous parental leave policy
Remote-friendly work environment