{"id":1621737,"url":"https://alion.io/job/studyfetch-head-of-security-cloud-corporate-physical","title":"Head of Security (Cloud, Corporate & Physical)","company":{"id":178211,"name":"StudyFetch","domain":"studyfetch.com","url":"https://alion.io/company/studyfetch","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Rippling","truth_index":{"grade":"B","score":75,"open_postings":6,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":null,"computed_at":"2026-10-15T05:46:00Z"}},"role":"Leadership","role_family":"Leadership","seniority":"head","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Beverly Hills, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":187000,"max_usd":350000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":2407},"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Agentic Workflows","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"DNS","optional":false},{"name":"FedRAMP","optional":false},{"name":"GCP","optional":false},{"name":"Google Workspace","optional":false},{"name":"IAM","optional":false},{"name":"ISO 27001","optional":false},{"name":"LLM","optional":false},{"name":"LLM Guardrails","optional":false},{"name":"NIST 800-53","optional":false},{"name":"SOC 2","optional":false},{"name":"Cloudflare","optional":true},{"name":"Pulumi","optional":true},{"name":"Terraform","optional":true},{"name":"Zero Trust","optional":true}],"status":"live","first_seen_at":"2026-09-24T03:34:31Z","employer_posted_date":"2026-09-24","last_verified_at":"2026-10-15T15:47:40Z","board_verified":true,"closed_at":null,"days_open":21,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":21},"description":"About Studyfetch\nStudyFetch builds AI-native learning products. StudyFetch serves students, and Honen serves workforce training, from universities to Fortune 500 teams. Millions of learners, a growing list of enterprise customers, and soon government agencies trust us with their data, and we take that seriously.\nThe role\nWe're hiring a Head of Security, your job will be protecting learners and the organizations that trust us with their people. You'll own security across our cloud, our company, our physical spaces, and our path into government markets. You'll also build an AI-native security program, where LLM agents continuously audit our code and infrastructure alongside you\nThis is a builder role. We already have a real foundation: SOC 2 Type II, ongoing third-party penetration testing, managed EDR, email and DNS filtering, Firewalls, network security etc. Now we need someone to own it, raise the bar, lead us through FedRAMP, and scale the program as we grow.\nYou'll be hands-on from day one, working directly with engineering and leadership. You'll also work with our IT Engineer, who handles day-to-day IT: onboarding, offboarding, devices, and employee support. You set the direction, and together you run corporate security and IT. As the company grows, you'll build and lead a broader security team.\nWhat you'll own\nCloud & product security\nOwn the security posture of our Google Cloud environment, including IAM, org policies, network controls, logging, and threat detection.\nWork with engineering on secure infrastructure-as-code, secrets management, credential rotation, and secure development practices.\nLead our third-party penetration testing program. You'll set scope and cadence, manage vendors, triage findings, and drive fixes to completion.\nOwn vulnerability disclosure intake.\nHelp set guardrails for how we build and use AI safely, covering data handling, prompt injection, and model and vendor risk.\nCorporate security & IT\nLead and mentor our IT Engineer, and set the priorities, standards, and processes for how we run IT.\nOwn identity and access strategy across Google Workspace and our SaaS stack, including SSO, MFA, and role-based access.\nOwn endpoint security and device management standards for our mostly-Mac fleet, with IT handling rollout and day-to-day support.\nDesign secure onboarding, offboarding, and quarterly access reviews with IT and People Ops, and automate them wherever possible.\nBuild security awareness into the culture without slowing people down.\nPhysical security\nOwn office security systems, including access control, cameras, alarms, and visitor management.\nSet policies for guests, deliveries, asset tracking, and after-hours access, and make sure front-of-house staff can run them smoothly.\nAI-native security\nDesign and run AI and LLM agent systems that continuously audit our codebases and infrastructure. That includes reviewing pull requests, scanning infrastructure-as-code, finding misconfigurations, and flagging risky changes before they ship.\nBuild agentic workflows that triage alerts, investigate findings, draft fixes, and collect compliance evidence automatically.\nSecure our own AI systems and agents: permissions and tool access, prompt injection defenses, sandboxing, audit logging, and data handling.\nEvaluate and adopt AI security tooling, and know when a human needs to stay in the loop.\nSet guardrails for how the whole company uses AI safely, including approved tools, sensitive data, and model and vendor risk.\nCompliance & trust\nOwn our SOC 2 program end to end: evidence, policies, vendor risk, and audits.\nBuild one automated, continuously monitored control set that serves every framework we pursue.\nBe our security voice with enterprise customers and universities, from answering security questionnaires to joining sales calls and building our trust center.\nNavigate student-data and privacy requirements such as FERPA, COPPA, and state privacy laws, along with emerging AI regulation.\nGovernment & public sector\nLead our FedRAMP program end to end: strategy, certification class, assessor selection, packaging, and continuous monitoring.\nOwn related frameworks as we expand, such as GovRAMP for state and local customers, NIST 800-53 and 800-171, and ISO 27001.\nWork with sales and leadership on public-sector deals, agency security reviews, and procurement.\nIncident response\nBuild and own our incident response plan, runbooks, and tabletop exercises.\nBe the calm, clear lead when something goes wrong.\nWhat you've done\n8+ years in security, with real hands-on time across cloud, corporate IT, and compliance. You've touched all of these areas, not just one.\nYou've been an early security leader at a startup and built programs from scratch as the company grew.\nYou've managed or mentored IT or security staff, and you can grow someone's skills while keeping the work moving.\nYou've led or played a central role in a FedRAMP authorization, either Rev5 or 20x, and you know what it takes to get it and keep it.\nYou know NIST 800-53 deeply and can map its controls onto a modern cloud stack.\nYou have strong cloud security experience, ideally on GCP. Deep AWS or Azure experience also works if you can get up to speed on GCP quickly.\nYou've taken a company through SOC 2 or ISO 27001, and you know the difference between real security and checkbox security.\nYou've run third-party pentest programs and turned the findings into shipped fixes.\nYou've owned or overseen physical security systems such as badge access, cameras, and visitor management.\nYou can explain risk to a CEO, a customer's CISO, a federal agency, and a new hire, each in terms that fit.\nNice to have\nHands-on experience with FedRAMP 20x, Key Security Indicators, or automated compliance pipelines\nExperience selling into government or higher ed, including GovRAMP or state procurement\nEligibility to work on federal systems, or an active or past clearance\nExperience with Vanta, Jamf, Google Cloud, AWS,Cloudflare Zero Trust, and Pulumi or Terraform\nWhy this role\nYou'll build the security function at a fast-growing AI company, with the scope to shape it your way.\nYou'll lead a FedRAMP program from the start, which is rare, career-defining work.\nYou'll lead from day one, with an IT Engineer reporting to you and room to grow the team as we scale.\nYou'll have a direct line to leadership, real ownership, and budgets.\nThe work matters: you'll protect learners and the organizations that trust us with their people.\nCompensation & benefits\n170,000-220,000 base salary, plus equity\n100% employer-paid Medical, Dental, and Vision; 75% dependent coverage\n401(k) with employer matching\nDaily team dinner provided in-office\nA small, mission-driven team changing how the world learns","description_format":"text","description_chars":6742,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Equity"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["EdTech Platforms"],"lifecycle":[{"event":"open","at":"2026-10-01T20:48:12Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 2","filings_12m":2,"filings_prev_12m":0,"green_card_filings_12m":0,"median_offered_wage_usd":137500,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)"],"filings_for_role_12m":0}],"liveness":{"score":61,"band":"ok","label":"Likely open","p_open":1,"p_active":0.819,"p_room":0.75,"age_days":21,"expected_fill_days":30,"reasons":["conf:1","win:late"],"computed_at":"2026-10-15T05:46:00Z"},"pay":null,"html_url":"https://alion.io/job/studyfetch-head-of-security-cloud-corporate-physical","json_url":"https://alion.io/job/studyfetch-head-of-security-cloud-corporate-physical.json","meta":{"generated_at":"2026-10-15T18:34:42Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":28225,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-16T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":178211},"rest":"https://alion.io/mcp/rest/get_company?id=178211"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fstudyfetch-head-of-security-cloud-corporate-physical"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fstudyfetch-head-of-security-cloud-corporate-physical"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fstudyfetch-head-of-security-cloud-corporate-physical"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/studyfetch-head-of-security-cloud-corporate-physical\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fstudyfetch-head-of-security-cloud-corporate-physical"}]}