安全主管
Head of Security
Tremendous 是一个全球平台，专为帮助企业向任何人、任何地点即时发送礼品卡和资金而设计。我们已获得 20,000 多家组织的信任，从初创公司到 Atlassian、MIT 和 United Way 等大型企业，帮助他们触达全球数百万接收者。
我们盈利且无需外部投资即可增长。我们是完全远程办公的，拥有高文档化、低会议的文化，让员工有更多时间专注于重要的工作——以及工作之外的生活。我们的员工 NPS 分数在 80 多分。
我们通过系统处理数十亿美元的资金。这使安全至关重要，这也是为什么我们首次进行专门的安全招聘。
关于该职位
你将是我们的第一位安全负责人。这里已经有一个坚实的基础——漏洞赏金、渗透测试、生产环境和代码方面的自动化代码与配置扫描，以及人员方面的钓鱼模拟。你将在访问与身份、SecOps 与监控、事件响应、供应商安全、员工安全实践和政策方面进行扩展。你将负责整个安全态势。
这是一个球员兼教练的角色。初期，你需要亲自进行范围界定和实际工作；这不是一个从上至下的指导角色。随着工作的需求，我们准备在这里组建团队——我们希望你来定义这个团队应该是什么样子以及何时组建。
你将向 VP of Engineering 汇报，这是 Tremendous 最高级别的技术领导者。我们特意将安全职能放在工程部门，这样你可以快速推动真正的实施——与你所保护的人员紧密合作，而不是被孤立在合规职能中。随着安全职能的成熟，我们会重新评估这一点。
你将负责的工作
- 全面负责 Tremendous 的安全态势，与我们的工程团队合作，确保生产基础设施和代码安全。
- 评估我们的差距，优先排序，并首先解决最高价值的差距。我们会提出意见，但你将负责优先级和实施。
- 将事件响应作为核心，而非事后考虑。我们可能无法防止一次攻击，但你的职责是确保它影响小、可控，并且我们知道该怎么做。
- 推动公司内部的安全文化转变——逐步引入控制措施，与团队合作而非凌驾于团队之上。“是的，而且”，而不是“不”。
- 领导我们的 AI 安全态势。我们大力投资 AI 工具；你的任务是管理这些风险并加以利用，而不是禁止它们。
- 确定何时以及如何扩充人手
查看英文原文
Tremendous is the global platform built for businesses to send payoutsâgift cards and moneyâto anyone, anywhere, instantly. We're trusted by 20,000+ organizations, from startups to giants like Atlassian, MIT, and United Way, to reach millions of recipients worldwide.
We're profitable and growing without outside investors. We're fully remote, with a high-documentation, low-meeting culture that leaves more time for the work that mattersâand for your life outside it. Our employee NPS sits in the high 80s.
We move billions of dollars through our systems. That makes security existential, and it's why we're making our first dedicated security hire.
About The Role
You'll be our first Head of Security. There's already a real foundation hereâbug bounty, pen tests, automated code and configuration scanning on the production and code side, phishing simulations on the people side. Youâll add to it across access and identity, SecOps and monitoring, incident response, vendor security, employee security practices, and policy. You'll own the whole posture.
This is a player-coach role. Early on, you'll do the scoping and the hands-on work yourself; this is not a role where you direct from above. As the work demands it, we're fully prepared to build a team hereâand we're looking to you to define what that team should be and when.
You'll report to the VP of Engineering, Tremendous' most senior technical leader. We've deliberately placed security with Engineering so you're set up to drive real implementation fastâembedded with the people whose work you're securing, not siloed in a compliance function. As the security function matures, we'll revisit this.
What You'll Do
- Own Tremendous' security posture end-to-end, partnering with our engineering team on production infrastructure and code security.
- Assess where we have gaps, prioritize them, and tackle our highest-leverage gaps first. Weâll have opinions, but you own the prioritization and implementation.
- Treat incident response as core, not afterthought. We may not be able to prevent a breach, but your job is making sure it's small, contained, and that we know exactly what to do.
- Drive security as a cultural shift across the companyâintroducing controls incrementally, working with teams rather than over them. "Yes, and," not "no."
- Lead our AI-security posture. We invest heavily in AI tooling; your job is to manage that risk and enable it, not to ban it.
- Define when and how to staff up the security function, and hire your own team.
What You'll Bring
- Real, hands-on security experience at a company that scaledâideally as an early security hire who grew with the business through high growth.
- Deep experience in at least one core security domainâproduct/production security, security operations, or access/identity and policyâwith enough range to reason across the others. You defined the security posture, not just executed someone elseâs playbook.
- An engineer's mindset. You reach for code to solve problems and can read our codebase and understand our infrastructure (Ruby on Rails; TypeScript + React; PostgreSQL; Google Cloud). You won't write much day-to-day, but you're not lost in the code.
- Judgment over checklists. You can explain the actual risk of a given decision, hold a firm line where it matters, and give ground where "best practice" doesn't apply to us or real business need pulls the other way. You can hold your own in a debate about whether to open up broad data access for AI tooling.
- Bedside manner. You drive hard change by bringing the team around to your point of view, rather than just telling them no. Engineers and the rest of the company want to work with you.
- Experience building or co-building a small security team is a plus.
- Fintech, payments, or regulated-industry experience is a plus.
What's Cool About The Role
- You define the function. First security leader, with the budget for the required tools and team.
- A real mandate. The push for this hire comes straight from the founders.
- We invest in your tools. Everyone has a $5k/month budget for AI tools. Use it.
- Competitive pay and equity. Base salary $250,000â$330,000, plus meaningful equity.
- Fully remote. Work from anywhere in the Americas.
- Great culture. Read more about how we work in our public handbook.
Compensation Range: $250K - $330K
Please mention the word **GOLDEN** and tag RMTE0LjIyOC42NC4xMzM= when applying to show you read the job post completely (#RMTE0LjIyOC42NC4xMzM=). This is a beta feature to avoid spam applicants. Companies can search these words to find applicants that read this and see they're human.