About this Role & Why it Matters

You will lead security, reporting to the Director of Technical Operations and working closely with the CTO’s organization. You will stay hands-on across data, cloud, application, and corporate security, lead incident response, and build and manage a small security engineering team. You will join the on-call rotation and use AI tools daily to build and maintain your work.

Security at Formation Bio protects clinical and patient data, the AI systems we build, and the applications our teams create every day. We are building an AI-native company, so security here is an engineering partnership, not a gate.

Key Responsibilities

• Lead incident response end to end, from triage and severity calls through containment, recovery, stakeholder communication, and post-incident reviews, and follow corrective actions through to closure. Join the on-call rotation, with the Director of Technical Operations as escalation.
• Stay hands-on in data, cloud (AWS and GCP), application, and corporate security, reviewing architecture, configuration, code, and pipelines with engineering teams and helping push fixes through to completion.
• Own data security for regulated clinical and patient data and for data used by AI systems, including access, classification, handling, and sharing controls.
• Secure our AI platform and agentic workflows: agent and service identity, credential and secrets handling, MCP connectors and tool permissions, and guardrails for AI agents that act on data and systems.
• Set guardrails and review paths for citizen-built applications so builders keep moving while risk stays managed.
• Operate and tune SIEM, EDR, and vulnerability management, and keep alerting and paging sustainable for an on-call team.
• Use AI tools to build and maintain detection, triage, and security automation, and hold that work to the same review and testing standards as code.
• Verify that controls work through detection tests, tabletop exercises, and assessments, and confirm fixes before closing findings.
• Run a risk-based security roadmap and lead security projects from scoping through delivery.
• Manage the security tooling and services budget, renewals, and vendor performance, and report to the Director and CTO each quarter on posture, material risks, and decisions needed.
• Keep governance lightweight and practical (risk register, policies, exceptions, AI governance), with controls and automated evidence that support GxP, HIPAA, and 21 CFR Part 11 obligations and make audit readiness routine.
• Partner with engineering, Enterprise AI, infrastructure, IT, and CSV as a technical peer, and drive security awareness using observed risks and incidents.
• Hire, coach, and manage security engineers with clear expectations, documented development plans, and growth paths.

Qualifications

Required

• 5+ years in security engineering or security operations, with hands-on depth in data, cloud, and application security.
• Led incident response to resolution and made independent severity calls under pressure.
• Reads and writes code and has partnered with engineers on secure design, remediation, and pipeline security.
• Uses AI tools daily and understands how to secure AI-enabled systems.
• Hands-on with SIEM, EDR, vulnerability management, and security automation.
• Has owned security tooling, budget, and vendor relationships.

Preferred

• Direct people-management experience, including feedback, development, and hiring.
• Experience with agentic identity and security, MCP integrations, or citizen-built application governance.
• Regulated-industry experience (life sciences, healthcare, fintech).
• Familiarity with HIPAA, GxP, and 21 CFR Part 11.

Who We Are Looking For

You are a builder at heart. You keep scope large and teams small, earn engineers’ trust through technical depth, and challenge assumptions with evidence. You use AI as a baseline in your own work and can secure the agentic systems and citizen-built applications our teams are creating. You are comfortable writing the playbook as you go, and you want to show that pharma can run on a modern, tech-first security culture.

What Success Looks Like

First 30 days

• Learn the environment: regulated data flows, the AI platform and agent workflows, citizen-built applications, cloud accounts, and current controls and tooling.
• Join the on-call rotation and validate escalation paths.
• Complete a gap analysis across data, cloud, application, and corporate security covering open risks, control gaps, and audit readiness.
• Prioritize the security work and agree on the roadmap with the Director.

At 3 months

• Baseline detection coverage, response time, vulnerability remediation, and control health, and tune alerting so on-call is sustainable.
• Ship the first high-priority fixes from the gap analysis with engineering teams, with emphasis on data security and cloud infrastructure.
• Ensure material control gaps have accountable owners and timelines.
• Run a tabletop exercise and the first round of control verification tests.
• Establish operating cadences for stakeholder communication, risk tracking, and quarterly reporting.

At 6 months

• Lead security incidents and routine operational decisions independently, with clear escalation of material business, legal, or regulatory risks.
• Show measurable improvement against the 90-day baselines in detection coverage, response performance, and vulnerability remediation.
• Make audit and assessment readiness a sustained operating practice with less last-minute effort and clearer evidence ownership.
• Have AI-assisted security automation in production that reduces manual work, with guardrails in place for agentic identity, MCP connectors, and citizen-built applications.
• Ensure every direct report has clear expectations and a documented development plan.

Total Compensation Range: $185,500 - $232,000