{"id":2607848,"url":"https://alion.io/job/bold-director-security","title":"Director, Security","company":{"id":1931513,"name":"BOLD","domain":"bold.com","url":"https://alion.io/company/bold-com","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":true,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":null},"role":"Leadership","role_family":"Leadership","seniority":"head","employment_type":null,"work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Noida, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":50000,"max_usd":131000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":37},"experience_years_min":12,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Amazon EKS","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Azure AKS","optional":false},{"name":"CI/CD","optional":false},{"name":"EU AI Act","optional":false},{"name":"GDPR","optional":false},{"name":"Go","optional":false},{"name":"GraphDB","optional":false},{"name":"IAM","optional":false},{"name":"Java","optional":false},{"name":"Kubernetes","optional":false},{"name":"Least Privilege","optional":false},{"name":"LLM","optional":false},{"name":"LLM Guardrails","optional":false},{"name":"OWASP","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"PCI DSS","optional":false},{"name":"Python","optional":false},{"name":"SQL","optional":false},{"name":"Terraform","optional":false},{"name":"Tool Use","optional":false},{"name":"Agentic Workflows","optional":true},{"name":"LLM Evaluation","optional":true},{"name":"NIST AI RMF","optional":true}],"status":"live","first_seen_at":"2026-10-15T08:54:29Z","employer_posted_date":"2026-10-15","last_verified_at":"2026-10-15T17:24:38Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"BOLD is looking for a Director of Security to own security across a large portfolio of client-facing products. Our products run on AWS and Azure, ship at high velocity across UI and backend, and make extensive use of AI and LLMs across the customer experience.\nThis is a builder's role, not an audit role. You will design security into our architecture, our delivery pipeline and our AI features, and lead the team that keeps it there. Compliance, certifications and penetration testing are part of the remit, but they are outcomes of a well-run program, not the program itself.\nWe want someone who has already thought hard about what changes when a product talks to a model: prompt injection and hijacking, data leaking through model context, agents with too much authority, and attackers who now use AI too.\n+ What you'll be securing:\n\nLayer\n\nWhat we run\n\nWhat we need from you\n\nCloud\n\nAWS and Azure, multi-account / multi-subscription\n\nOne identity, policy and posture model across both clouds\n\nCompute\n\nKubernetes (EKS / AKS), containers, CI/CD\n\nSupply-chain integrity, runtime detection, least-privilege workloads\n\nEdge\n\nCDNs, WAF, bot detection agents\n\nTuned defences against scraping, credential stuffing and AI-driven bots\n\nAPIs\n\nPublic and partner APIs behind API protection\n\nDiscovery, schema enforcement, abuse and BOLA/BFLA detection\n\nApplications\n\nModern web front ends and backend services\n\nSecure-by-default frameworks and paved roads for engineers\n\nAI\n\nExtensive use of AI and LLMs in client-facing features\n\nAn LLM threat model, guardrails, evals and monitoring in production\n\nABOUT THIS TEAM\nBOLD Platform services team design, creates, manage and maintains the highly scalable and distributed services for the wider use of web and mobile product applications/portals/websites. The current list of services is based on Microservices architecture whose domain ranges from visitor tracking, User profiles, authentication, content and payments.\nPlatform team uses state of the art modern technologies like .Net framework, Python, Java, SQL Server, My SQL, Graph DB, SOLR, and a lot of other tools & technologies serving millions of users with hundreds of million transactions everyday through a scalable and fault tolerant architecture.\nWHAT YOU’LL DO\n AI and LLM security: Own the threat model for every AI/LLM-powered feature, covering prompt injection and prompt hijacking (direct and indirect), jailbreaks, system-prompt and data leakage, insecure output handling, excessive agency in tool-calling, and model denial-of-wallet.\nAI assurance: Build adversarial evals and red-team exercises for AI features into the release process, with production monitoring for abuse and drift. Govern internal AI use, including coding assistants, agents with repo or cloud access, plugin integrations and shadow AI.\nMulticloud security: Set a unified security architecture across AWS and Azure: identity federation and guardrail policies. Harden Kubernetes with admission control, network policy, workload identity and runtime threat detection.\nEdge defences and real-time tuning: Own edge security across every client-facing product, working with Architecture and Technical Operations on real-time tuning of DDoS mitigation thresholds, rate limits, bot-score and challenge thresholds, and WAF rule sensitivity, balancing attacks blocked against false positives for real customers.\nAPI security: Run an API security program covering inventory of every endpoint, authentication and authorization patterns, rate limiting and abuse detection.\nSecure engineering: Build paved roads so the secure way is the easy way. Embed SAST, SCA, secrets and IaC scanning and SBOMs in CI/CD, secure the software supply chain, and lead design reviews and threat modelling as a peer to architects.\nDetection and response: Own detection engineering and incident response across cloud, Kubernetes, edge and AI layers, including runbooks for AI-specific incidents, tabletop exercises and post-incident reviews.\nTooling and budget: Own the security tooling budget: build business cases, rationalise overlapping tools, negotiate with vendors and track spend against risk reduced. Partner with Architecture and Technical Operations on tooling decisions from evaluation to rollout, and agree who owns which detection thresholds during a live attack.\nGovernance and compliance: Set direction for governance, risk and compliance, working with our in-house GRC team, which owns day-to-day delivery. Ensure compliance with GDPR, PCI DSS and the EU AI Act is a byproduct of engineering controls, with automated evidence.\nRisk and assurance: Make the calls on high-impact third-party risk, especially AI providers. Scope and direct penetration tests and bug bounty, and represent security to enterprise clients on strategic deals.\n Leadership: Build and lead a small, high-leverage team (application, cloud and AI security), work closely with our in-house GRC team, grow security champions inside engineering, and report risk posture and program metrics to executive leadership in plain business terms.\nWHAT YOU’LL NEED\n12+ years in security, including 4+ years leading a security function in a product engineering organisation with a multi-product, client-facing portfolio, including ownership of its tooling budget.\nHands-on depth in cloud security on both AWS and Azure; able to read an IAM policy, a Terraform plan and a Kubernetes manifest and spot the problem.\nPractical experience securing AI/LLM-powered features in production, including defending against prompt injection and hijacking.\nStrong application and API security background: OWASP Top 10 and API Top 10, OAuth/OIDC, authorization design and secure SDLC.\nExperience running and tuning edge defences in production (CDN/WAF, DDoS mitigation, bot management and API protection platforms), including threshold tuning during live traffic events.\nDetection and incident response leadership, including at least one serious incident handled end to end.\nHas overseen compliance programs such as GDPR, PCI DSS or EU AI Act readiness alongside a GRC team.\nComfortable writing code or scripts (Python, Go or similar) to automate, prototype and review.\nCommunicates risk to engineers and executives with equal clarity, and earns trust by enabling delivery rather than blocking it.\nWHAT’S GOOD TO HAVE\nHas built LLM red-teaming or eval harnesses, or contributed to OWASP GenAI, MITRE ATLAS or similar work.\nExperience with AI gateways or LLM firewalls, and with securing agentic workflows.\nBackground working alongside data science teams on model and data pipeline security.\nFamiliarity with the OWASP Top 10 for LLM Applications and the NIST AI RMF.\nCertifications such as CISSP, CCSP, OSCP or cloud security specialties (valued, not required).\nEXPERIENCE- \nDirector, Security- 12years+\n #LI-Hybrid\nAbout Bold\nWe Transform Work Lives\nAs an established global organization, BOLD helps people find jobs. Our story is one of growth, success, and professional fulfillment. We create digital products that have empowered millions of people in 180 countries to build stronger resumes, cover letters, and CVs. The result of our work helps people interview confidently, finding the right job in less time. Our employees are experts, learners, contributors, and creatives.\nWe Celebrate And Promote Diversity And Inclusion\nWe value our position as an Equal Opportunity Employer. We hire based on qualifications, merit, and our business needs. We don't discriminate regarding race, color, religion, gender, pregnancy, national origin or citizenship, ancestry, age, physical or mental disability, veteran status, sexual orientation, gender identity or expression, marital status, genetic information, or any other applicable characteristic protected by law.\nUnder San Francisco's Fair Chance Ordinance, qualified applicants with arrest and conviction records will be considered for the position.","description_format":"text","description_chars":7909,"description_truncated":false,"requirements":{"experience_years_min":12,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"India","iso":"IN","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Recruiting & Staffing","Job Boards & Aggregators"],"lifecycle":[{"event":"open","at":"2026-10-15T10:15:09Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":26,"reasons":["conf:0","win:early"],"computed_at":"2026-10-15T17:48:51Z"},"pay":null,"html_url":"https://alion.io/job/bold-director-security","json_url":"https://alion.io/job/bold-director-security.json","meta":{"generated_at":"2026-10-15T17:48:51Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":26888,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-16T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1931513},"rest":"https://alion.io/mcp/rest/get_company?id=1931513"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fbold-director-security"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fbold-director-security"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fbold-director-security"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/bold-director-security\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fbold-director-security"}]}