Head of Corporate and Information Security

The Opportunity

• Own Layer's security strategy and risk program. Develop a comprehensive understanding of our existing security posture across our product, cloud infrastructure, corporate systems, endpoints, vendors, and operational processes. Build on existing SOC2 Type 2 compliant security program and establish a risk-based roadmap, identify gaps, and help leadership make informed decisions about where to invest on our journey towards ISO 27001.
• Define and continuously improve our existing technical security posture. Partner closely with engineering and infrastructure teams to strengthen security across our GCP environments and software development lifecycle. Depending on the risks you identify, this may include areas such as cloud IAM and service accounts, network security, secrets and key management, vulnerability management, secure configuration, CI/CD and code security, logging and monitoring, or security architecture reviews.
• Protect sensitive data throughout its lifecycle. Define and improve upon the existing controls necessary to protect PHI, customer data, credentials, and other sensitive information wherever it is stored, processed, or transmitted. Examples might include data classification and DLP capabilities, access controls, egress protections, retention policies, secrets scanning, or controls within Google Workspace and endpoints.
• Continue to build out our detection, incident response, and security operations capabilities. Ensure we have the visibility and operational processes necessary to detect, investigate, contain, and learn from security events. This may include improving centralized security telemetry and SIEM capabilities, detection and alerting strategies, incident response processes, in addition to running exercises and coordinating investigations when incidents occur.
• Own corporate security. Refine our security posture across employee identity, endpoints, SaaS applications, and other corporate systems. Work closely with Operations and IT stakeholders on areas such as identity and access management, endpoint security, device management, employee lifecycle controls, and account management.
• Strengthen our human security posture. Build upon our existing comprehensive security awareness and training program, including regular phishing simulations and social engineering exercises, to empower employees as our first line of defense against human-based threats.
• Work with the Chief Privacy Officer and other members of the leadership team to identify key security risks and establish a strategic plan that balances robust risk management with other organizational priorities.

Your Background

• 7+ years of experience in information security, security engineering, or related roles, with meaningful ownership across multiple areas of a security program rather than deep experience in only one specialty.
• Experience building or materially evolving a security program in a startup, growth-stage technology company, or similarly fast-moving environment. You are comfortable starting with incomplete systems and deciding what matters most.
• Strong technical depth in modern cloud environments. You should be comfortable reasoning about areas such as cloud IAM, networking, application and infrastructure security, data protection, secrets management, logging and detection, vulnerability management, and endpoint or identity security. Hands-on GCP experience is strongly preferred; equivalent AWS or Azure experience is relevant.
• Experience working closely with software engineering and infrastructure teams and enough technical fluency to evaluate architecture, investigate security issues, and implement or meaningfully contribute to technical controls yourself.
• Strong understanding of security operations and incident response, including how to build useful telemetry, detection, investigation, escalation, and response capabilities. Experience with SIEM and related security tooling is valuable, but we care more about your ability to design the overall capability than familiarity with a particular product.
• Experience protecting sensitive data in regulated environments. Healthcare experience - particularly HIPAA and PHI handling - is strongly preferred, although experience in other highly regulated industries may also be relevant.
• Experience with security and compliance frameworks such as SOC 2 and ISO 27001, including translating framework requirements into effective operational and technical controls. Experience leading an organization through ISO 27001 certification is a plus.
• Strong risk judgment. You can distinguish between theoretical issues and meaningful business risk, prioritize accordingly, and explain the tradeoffs behind your recommendations.
• A builder's mindset. You are comfortable moving between strategy, architecture, tooling, policy, investigation, and implementation, particularly while the security team is small.
• A clear and credible communicator who can discuss technical security issues with engineers, explain risk and investment decisions to executives, and represent Layer effectively with customers' security and compliance teams.

Pay and benefits

Expected compensation range for this role is $180,000-$230,000. Compensation is dependent on experience and overall fit to our role. Expected compensation ranges for this role may change over time. If your compensation requirement is greater than our posted salary ranges, please still consider applying to our role. We will make a determination as to whether an exception can be made.

If you are excited about this role, we encourage you to apply even if you don't feel that you meet every single requirement. We're eager to meet people that believe in our mission and can contribute to our team in a variety of ways. We welcome diverse perspectives, rigorous thinking, and fearlessness in challenging the status quo.

Join us and help us transform healthcare with AI.