Head of Security

Infinity Constellation

full-time

Posted on: 9/20/2025

Origin: • 🇺🇸 United States

✨ AI Apply

Lead

AWSCloudGoogle Cloud PlatformSDLC

About the role

Design and oversee security strategy across the entire Infinity portfolio.
Build portfolio-wide security policies, standards, and controls.
Own certification/compliance programs (SOC 2, ISO 27001, HIPAA, GDPR/CCPA alignment, etc.).
Maintain a central library of security documentation to support sales and client diligence.
Develop and oversee vendor/third-party risk management and implement data classification, retention, and destruction policies.
Ensure consistent incident response, access review, and audit cadences across companies.
Partner with engineering and leadership teams at portfolio companies to establish secure practices from day one.
Lead security diligence with client and vendor teams and support client/vendor diligence reviews.
Standardize secure development lifecycles, access management, and cloud security baselines.
Implement incident response framework, run tabletop exercises, penetration testing, and remediation tracking.
Build continuity/disaster recovery standards that scale across companies.
Lead company-wide security training and awareness programs and foster a secure-by-default culture.

7+ years in security leadership roles, ideally spanning both startup and enterprise contexts.
Track record of building and running SOC 2, HIPAA, ISO 27001, or equivalent programs.
Experience in client facing roles interfacing directly with stakeholders and client security teams as a part of the sales process.
Strong technical understanding of cloud security (AWS/GCP), encryption, identity and access management, and secure SDLC practices.
Experience successfully navigating client/vendor security diligence processes.
Ability to operate both strategically (designing systems for scale) and tactically (closing gaps in fast-moving environments).
Experience with incident response frameworks, penetration testing, remediation tracking, vendor/third-party risk management, data classification, retention, and destruction policies.