Head of Security (Cloud, Corporate & Physical)

The role

We're hiring a Head of Security, your job will be protecting learners and the organizations that trust us with their people. You'll own security across our cloud, our company, our physical spaces, and our path into government markets. You'll also build an AI-native security program, where LLM agents continuously audit our code and infrastructure alongside you

This is a builder role. We already have a real foundation: SOC 2 Type II, ongoing third-party penetration testing, managed EDR, email and DNS filtering, Firewalls, network security etc. Now we need someone to own it, raise the bar, lead us through FedRAMP, and scale the program as we grow.

You'll be hands-on from day one, working directly with engineering and leadership. You'll also work with our IT Engineer, who handles day-to-day IT: onboarding, offboarding, devices, and employee support. You set the direction, and together you run corporate security and IT. As the company grows, you'll build and lead a broader security team.

What you'll own

Cloud & product security

• Own the security posture of our Google Cloud environment, including IAM, org policies, network controls, logging, and threat detection.
• Work with engineering on secure infrastructure-as-code, secrets management, credential rotation, and secure development practices.
• Lead our third-party penetration testing program. You'll set scope and cadence, manage vendors, triage findings, and drive fixes to completion.
• Own vulnerability disclosure intake.
• Help set guardrails for how we build and use AI safely, covering data handling, prompt injection, and model and vendor risk.

Corporate security & IT

• Lead and mentor our IT Engineer, and set the priorities, standards, and processes for how we run IT.
• Own identity and access strategy across Google Workspace and our SaaS stack, including SSO, MFA, and role-based access.
• Own endpoint security and device management standards for our mostly-Mac fleet, with IT handling rollout and day-to-day support.
• Design secure onboarding, offboarding, and quarterly access reviews with IT and People Ops, and automate them wherever possible.
• Build security awareness into the culture without slowing people down.

Physical security

• Own office security systems, including access control, cameras, alarms, and visitor management.
• Set policies for guests, deliveries, asset tracking, and after-hours access, and make sure front-of-house staff can run them smoothly.

AI-native security

• Design and run AI and LLM agent systems that continuously audit our codebases and infrastructure. That includes reviewing pull requests, scanning infrastructure-as-code, finding misconfigurations, and flagging risky changes before they ship.