Remote opportunity at
Tonic.aiHead of Security
Tonic.ai seeks a Head of Security to lead its security operations and strategy. Since 2018, Tonic.ai has de-identified sensitive data for enterprises such as eBay, UnitedHealth…
Career Tools
About This Role
Tonic.ai seeks a Head of Security to lead its security operations and strategy. Since 2018, Tonic.ai has de-identified sensitive data for enterprises such as eBay, UnitedHealth Group, Qualcomm, Commonwealth Bank, and Mercor. Because the organization handles production databases, financial and patient records, and emerging AI training materials, security serves as a core component of its business offerings. In this remote, full-time role, the Head of Security will function as the…
Job Description
Tonic.ai seeks a Head of Security to lead its security operations and strategy. Since 2018, Tonic.ai has de-identified sensitive data for enterprises such as eBay, UnitedHealth Group, Qualcomm, Commonwealth Bank, and Mercor. Because the organization handles production databases, financial and patient records, and emerging AI training materials, security serves as a core component of its business offerings.
In this remote, full-time role, the Head of Security will function as the primary senior security authority, collaborating closely with the founders, engineering, DevOps, sales, and legal teams. Responsibilities span end-to-end oversight of the SOC 2 program, cloud environment governance across AWS, GCP, and Azure, vulnerability management, customer-facing security engagements, corporate IT, and internal AI usage policies. The ideal candidate brings a background in leading security at business-to-business software enterprises, hands-on cloud administration expertise, comfort interfacing with enterprise customers, and self-directed operational capability.
Responsibilities
- Manage the SOC 2 program from scope and evidence collection to control remediation and auditor interactions
- Maintain alignment with GDPR, HIPAA, and contractual customer commitments
- Collaborate with engineering to integrate security throughout the software development lifecycle
- Execute vulnerability management across code, infrastructure, and dependencies
- Govern and secure AWS, GCP, and Azure cloud environments
- Handle customer-facing security questionnaires, RFP responses, and sales calls
- Partner with legal on contract negotiations and security redlines
- Direct corporate security and IT functions including endpoint management, EDR monitoring, and incident response
- Oversee identity and access management and vendor risk management company-wide
- Establish and update guidelines for employee AI usage across LLM platforms, coding assistants, and connectors
Requirements
- Several years of experience leading security at a business-to-business software company with a track record of building programs
- Hands-on experience managing SOC 2 audits end to end along with working knowledge of GDPR and HIPAA
- Practical experience securing AWS, GCP, and Azure environments
- Background in embedding security into development lifecycles and running vulnerability management
- Experience interacting directly with customers, answering security questionnaires, and communicating with CISOs
- Familiarity running corporate security and IT including endpoint management, EDR, incident response, and IAM
- Understanding of AI tools, associated risks, and practical guardrail implementation
- Ability to operate with self-direction and make risk-based decisions independently
- Clear communication skills across technical and executive audiences
Qualifications
- Experience at a data infrastructure, privacy, or AI organization
- Background selling into regulated sectors like financial services and healthcare
- Familiarity with ISO 27001, HITRUST, or FedRAMP frameworks
- Experience securing software deployed by customers in their own environments alongside SaaS
- Background at an early-stage or fast-growing company
Core Skills
Benefits
- Competitive salary and equity
- Unlimited paid time off
- 401k plan with employer contribution
- Medical, dental, and vision insurance
- Generous parental leave policy
- Remote-friendly work environment
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
Is this position remote?
Yes, the source posting indicates a remote-friendly work environment.
What is the employment type?
This is a full-time position.
What is the salary for this role?
The specific salary is not stated in the job posting, though the role offers competitive compensation and equity.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.