Title: Head of Security
Location: Remote

About the role:
We want a hands-on security leader who has been in the room when things broke and led the response. You'll own application security, security operations, and corporate security, and be the person customers and leadership trust when something goes wrong.

What you'll own:

Application security

• Own the secure SDLC: threat modelling, security design reviews, and secure coding standards.

• Build security tooling into CI/CD: SAST, DAST, SCA, secrets scanning, and IaC scanning, with fixes that engineers can actually act on.

• Own vulnerability management for the product: triage, remediation SLAs, pen tests, and a bug bounty or responsible disclosure program.

• Secure a multi-tenant SaaS platform, including tenant isolation, authentication and authorisation, API security, and data protection.

• Secure AI and LLM features against prompt injection, data leakage, and model and vendor risk.

• Work as a partner to engineering leaders so security speeds teams up instead of blocking them.

• Support SOC 2 and ISO 27001 controls and customer security reviews, working with the GRC team.

Security operations and incident response

• Own existing SOC team and MDR partnership. You'll lead the in-house SOC, manage the MDR relationship, scope, and SLAs, and keep raising the bar on 24x7 monitoring, alert triage, escalation, and response quality.

• Own detection engineering: what we log, the SIEM and EDR stack, detection rules, and tuning to cut noise.

• Own the incident response program: playbooks, severity levels, on-call, war rooms, and blameless post-incident reviews that lead to real fixes.

• Lead live incidents from detection through containment, eradication, recovery, and customer and regulatory notification.

• Run regular tabletop exercises and red team or purple team drills.

• Own threat intelligence and threat hunting for our cloud, corporate, and product environments.

Corporate security

• Secure corporate IT: identity and SSO, MFA, device management, endpoint protection, and email security.

What we're looking for

• 6+ years of experience in security.

• Battle-tested incident leadership. You've personally led response to real, high severity incidents (breaches, ransomware, account takeovers, cloud compromises, or major vulnerabilities like Log4Shell) and can walk us through what happened, what you decided, and what you changed afterwards.

• Strong AppSec background: you've built a secure SDLC program at a SaaS company and can review architecture and code yourself.

• Experience leading an in-house SOC team and managing an MDR or MSSP provider, including holding them to SLAs, with deep familiarity with SIEM, SOAR, EDR/XDR, and cloud-native detection (AWS GuardDuty, CloudTrail, Security Hub, or equivalents).

• Solid cloud security skills, ideally AWS.

• Experience securing corporate IT and identity.

• Working knowledge of MITRE ATT&CK, OWASP Top 10 and ASVS, and NIST incident response guidance.

• Calm under pressure, a clear communicator during incidents, and able to brief both engineers and executives.

Nice to have

• Experience at a B2B SaaS, security, or compliance company.

• Certifications such as GCIH, GCIA, OSCP, OSWE, or CISSP.

• Digital forensics experience.

• Experience securing AI/LLM products