Tonic.ai has been de-identifying sensitive data since 2018, and hundreds of enterprises use our products, among them eBay, UnitedHealth Group, Qualcomm, Commonwealth Bank, and Mercor. Our customers hand us some of the most sensitive data they have: production databases, patient and financial records, and increasingly the email, chat, documents and code that AI labs want to train on.
That makes security part of what we sell, not just how we operate. Every deal runs through a security review, every customer asks how their data is protected, and the AI tools our own team uses every day raise new questions faster than most policies can keep up. We're looking for a Head of Security who can own all of it.
Why This Role, Why Now
Our customers are getting bigger and more regulated, and our products now sit in the middle of AI training-data deals where the buyer, the seller and their lawyers all want proof that the data was handled safely. The bar for our own security program is rising with them. What keeps deals moving is a security leader who can pass the audit, answer the questionnaire, get on the call with a customer's CISO, and keep our own house in order at the same time.
That's this job. You'll be Tonic's senior security leader, working directly with our founders, engineering, DevOps, sales and legal. You'll own the program end to end, setting the strategy and doing much of the hands-on work yourself.
What You'll Do
- Own our SOC 2 program end to end: scoping, evidence collection, control remediation, and the auditor relationship.
- Keep our practices aligned with GDPR, HIPAA, and the security commitments in our customer contracts.
- Partner with engineering to build security into the development lifecycle, from design review through release, so products ship securely and on time.
- Run vulnerability management across our code, dependencies, and infrastructure, including pen tests and remediation tracking.
- Secure and govern our AWS, GCP, and Azure environments (IAM, configuration, logging, hardening), working closely with DevOps and backend engineers.
- Act as the customer-facing security expert. Own security questionnaires and RFP responses, and join sales calls when a customer wants to go deep.
- Work with legal on contract negotiations and security redlines.
- Run corporate security and IT: endpoint management and laptop hardening, EDR monitoring, and incident response.
