Head of Security

Role Overview

Head of Security (first dedicated security hire) at Tremendous. This is a player-coach role where you will both shape and execute security strategy early on, with the ability to grow into building a security team.

Responsibilities

• Own Tremendous’ security posture end-to-end across production and people security.
• Partner with Engineering on production infrastructure and code security; assess gaps, prioritize, and implement highest-leverage improvements.
• Make incident response a core capability: minimize breach impact, ensure containment, and establish clear response actions.
• Drive security as a company-wide cultural shift, introducing controls incrementally and working with teams.
• Lead AI security posture by managing risk from the company’s AI tooling (enable appropriately, not just prohibit).
• Oversee access and identity, SecOps and monitoring, vendor security, employee security practices, and security policy.
• Define staffing and team growth, hiring and shaping the security function as needs evolve.

Requirements

• Real, hands-on security experience gained at a company that scaled—ideally as an early security leader.
• Deep expertise in at least one core area:
  • product/production security,
  • security operations,
  • or access/identity and policy, with enough breadth to reason across adjacent domains.
• Evidence of defining security posture (not only executing checklists).
• Engineer’s mindset: comfortable reading and understanding the codebase and infrastructure (Ruby on Rails; TypeScript + React; PostgreSQL; Google Cloud).
• Strong judgment and risk reasoning, including debating tradeoffs (e.g., granting AI tools broader data access).
• Ability to drive change through influence and collaboration (bedside manner).

Nice-to-haves

• Experience building or co-building a small security team.
• Fintech, payments, or other regulated industry experience.

Reporting / Collaboration

• Reports to the VP of Engineering, and security is deliberately embedded with Engineering for fast implementation.