Head of Security & AI Governance

Flip builds Voice AI that powers millions of phone calls every month for hundreds of brands—from Under Armour and Tory Burch in retail to Experity and Fast Pace Health in healthcare. We’re a tight-knit team of 50 with offices in NYC, LA, and the UK, known for both high-energy collaboration and deep customer trust.

About the role

Security and compliance are not checkboxes at Flip; they’re foundational to how we earn and keep the trust of the world’s largest enterprises. As AI increasingly represents brands, makes decisions, and interacts directly with customers, the security and trust model must evolve. We’re looking for a hands-on leader to own Flip’s security, compliance, IT, and AI governance program as we scale. This role is for someone who can define the future of AI governance while also building the systems, controls, and processes we need today. You’ll move fluidly between customer security calls, SOC 2 controls, Okta governance, internal IT, AI risk, vendor diligence, and emerging challenges like LLM security, prompt injection, red teaming, data boundaries, logging, retention, and model risk. We want someone who doesn’t just answer security questionnaires but challenges them—someone who can say, “They’re asking the wrong questions,” and help define the right ones.

Responsibilities

• Own SOC 2, HIPAA readiness, audit evidence, access reviews, and security controls
• Lead customer security diligence, questionnaires, trust materials, and vendor reviews
• Manage internal IT and security operations across the full stack
• Build AI governance frameworks for data flows, model/vendor risk, prompt injection, jailbreaks, evals, logging, retention, and customer data boundaries
• Develop and maintain security policies, runbooks, training, incident response, and internal control documentation
• Oversee access governance, admin policies, role-based access, and separation of duties across IT, Engineering, DevOps, and business systems
• Drive external security and trust conversations with enterprise customers and prospects
• Select and manage tools, MSPs, and vendors to scale Flip securely

Requirements

• 6+ years of experience across security, compliance, IT operations, GRC, infrastructure security, or corporate systems
• Experience owning or materially operating a SOC 2 program
• Hands-on expertise with MDM, endpoint security, device lifecycle, SaaS access governance, and internal IT operations
• Ability to work cross-functionally with engineering, sales, and other teams
• Credibility in speaking with enterprise customers about security, compliance, and trust
• Strong judgment, high attention to detail, and low tolerance for sloppy access or unclear ownership
• Curiosity and fluency in AI governance, LLM security, data boundaries, model/vendor risk, red teaming, and emerging enterprise trust expectations
• A builder mindset: you can design policy, implement workflows, chase evidence, clean up processes, and improve them over time

Who this is for

This role is for someone who wants to own the whole problem—from strategic customer calls about AI governance to tightening access workflows, cleaning up Okta groups, improving audit evidence, managing vendors, or building processes from scratch. You won’t inherit a perfect machine; you’ll build it. If you’re looking for a narrow GRC role, this isn’t it. If you want to define the trust model for AI-native software while doing the practical work to keep a fast-growing company secure, we’d love to meet you.

Benefits

• Comprehensive healthcare coverage
• Unlimited vacation, plus company-wide time off around July 4 and the end of the year

Location: Marina del Rey, CA (Onsite Monday - Friday)
Reports to: CTO