Head of Security (Cloud, Corporate & Physical)

We need to output HTML fragment with sections: About the role? Actually the posting includes "About Studyfetch" then "The role". We should not repeat job title as heading. Use

for section headings like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We need to include sections only when posting has real specific content. We have content: About Studyfetch (company description) maybe as "About the role"? Actually "About Studyfetch" is company overview. Could be "About the role" heading? The instruction: use

for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So we can create sections: About the role (maybe summarizing the role description), Responsibilities (list of duties), Requirements/Qualifications (maybe combine), Skills, Benefits, Pay, Schedule. We need to preserve all substantive info, not invent. Remove boilerplate. We need to parse the posting: - About Studyfetch: description of company. - The role: description of role. - Then bullet-like paragraphs: "You'll own security across..." etc. Those are responsibilities. - Then "What you'll own" with subheadings: Cloud & product security, Corporate security & IT, Physical security, AI-native security, Compliance & trust, Government & public sector, Incident response. Those are responsibilities categories. - Then "What you've done": requirements/experience. - Then "Nice to have": optional qualifications. - Then "Why this role": maybe benefits? Actually it's motivation. - Then "Compensation & Benefits": includes salary range, benefits list. We need to output sections: About the role (maybe combine About Studyfetch and The role?), Responsibilities (list of duties), Requirements (experience), Qualifications (maybe nice to have?), Skills (maybe specific skills like GCP, etc.), Benefits, Pay, Schedule (none). Since schedule not mentioned, we should not include Schedule section. We must not include headings with filler text. So only include sections where we have real content. We need to use

• for any list of duties/requirements/benefits. Use

  for prose. We need to preserve all substantive info; do not invent or summarize away detail. So we need to keep specifics like salary range, benefits list, etc. We must not include cookie/navigation/legal/EEO etc. Not present. We need to output only HTML fragment. Let's structure:

  About the role

  StudyFetch builds AI-native learning products. StudyFetch serves students, and Honen serves workforce training, from universities to Fortune 500 teams. Millions of learners, a growing list of enterprise customers, and soon government agencies trust us with their data, and we take that seriously. The role: We're hiring a Head of Security, your job will be protecting learners and the organizations that trust us with their people. You'll own security across our cloud, our company, our physical spaces, and our path into government markets. You'll also build an AI-native security program, where LLM agents continuously audit our code and infrastructure alongside you. This is a builder role. We already have a real foundation: SOC 2 Type II, ongoing third-party penetration testing, managed EDR, email and DNS filtering, Firewalls, network security etc. Now we need someone to own it, raise the bar, lead us through FedRAMP, and scale the program as we grow. You'll be hands-on from day one, working directly with engineering and leadership. You'll also work with our IT Engineer, who handles day-to-day IT: onboarding, offboarding, devices, and employee support. You set the direction, and together you run corporate security and IT. As the company grows, you'll build and lead a broader security team.

  Then Responsibilities: we can list bullet points from "What you'll own" sections. We need to capture each duty as
• . Could group under headings? But we only need
  • for any list. Could have multiple
    sections. We'll produce a
    with items for each responsibility bullet. Let's extract responsibilities: From "What you'll own": - Cloud & product security: Own the security posture of our Google Cloud environment, including IAM, org policies, network controls, logging, and threat detection. Work with engineering on secure infrastructure-as-code, secrets management, credential rotation, and secure development practices. Lead our third-party penetration testing program. You'll set scope and cadence, manage vendors, triage findings, and drive fixes to completion. Own vulnerability disclosure intake. Help set guardrails for how we build and use AI safely, covering data handling, prompt injection, and model and vendor risk. - Corporate security & IT: Lead and mentor our IT Engineer, and set the priorities, standards, and processes for how we run IT. Own identity and access strategy across Google Workspace and our SaaS stack, including SSO, MFA, and role-based access. Own endpoint security and device management standards for our mostly-Mac fleet, with IT handling rollout and day-to-day support. Design secure onboarding, offboarding, and quarterly access reviews with IT and People Ops, and automate them wherever possible. Build security awareness into the culture without slowing people down. - Physical security: Own office security systems, including access control, cameras, alarms, and visitor management. Set policies for guests, deliveries, asset tracking, and after-hours access, and make sure front-of-house staff can run them smoothly. - AI-native security: Design and run AI and LLM agent systems that continuously audit our codebases and infrastructure. That includes reviewing pull requests, scanning infrastructure-as-code, finding misconfigurations, and flagging risky changes before they ship. Build agentic workflows that triage alerts, investigate findings, draft fixes, and collect compliance evidence automatically. Secure our own AI systems and agents: permissions and tool access, prompt injection defenses, sandboxing, audit logging, and data handling. Evaluate and adopt AI security tooling, and know when a human needs to stay in the loop. Set guardrails for how the whole company uses AI safely, including approved tools, sensitive data, and model and vendor risk. - Compliance & trust: Own our SOC 2 program end to end: evidence, policies, vendor risk, and audits. Build one automated, continuously monitored control set that serves every framework we pursue. Be our security voice with enterprise customers and universities, from answering security questionnaires to joining sales calls and building our trust center. Navigate student-data and privacy requirements such as FERPA, COPPA, and state privacy laws, along with emerging AI regulation. - Government & public sector: Lead our FedRAMP program end to end: strategy, certification class, assessor selection, packaging, and continuous monitoring. Own related frameworks as we expand, such as GovRAMP for state and local customers, NIST 800-53 and 800-171, and ISO 27001. Work with sales and leadership on public-sector deals, agency security reviews, and procurement. - Incident response: Build and own our incident response plan, runbooks, and tabletop exercises. Be the calm, clear lead when something goes wrong. We could break each sentence into separate
    • but that may be too granular. The instruction: "Use
      • for any list of duties/requirements/benefits". So we can treat each bullet as a list item. Could combine multiple sentences into one
      • if they belong to same duty. Probably okay to have each major bullet as
      • . We'll keep each major bullet as
      • with the content. Thus we produce a
        with each of the above sections as
        • . Might be long but okay. Then Requirements: "What you've done" list: - 8+ years in security, with real hands-on time across cloud, corporate IT, and compliance. You've touched all of these areas, not just one. - You've been an early security leader at a startup and built programs from scratch as the company grew. - You've managed or mentored IT or security staff, and you can grow someone's skills while keeping the work moving. - You've led or played a central role in a FedRAMP authorization, either Rev5 or 20x, and you know what it takes to get it and keep it. - You know NIST 800-53 deeply and can map its controls onto a modern cloud stack. - You have strong cloud security experience, ideally on GCP. Deep AWS or Azure experience also works if you can get up to speed on GCP quickly. - You've taken a company through SOC 2 or ISO 27001, and you know the difference between real security and checkbox security. - You've run third-party pentest programs and turned the findings into shipped fixes. - You've owned or overseen physical security systems such as badge access, cameras, and visitor management. - You can explain risk to a CEO, a customer's CISO, a federal agency, and a new hire, each in terms that fit. We'll put each as
        • under a
          inside a section

          Requirements

          . Nice to have: could be under

          Nice to have

          or Qualifications? The instruction includes Qualifications as a possible heading. We could put Nice to have under Qualifications. But we need to preserve content. We'll make a section

          Qualifications

          with
          for nice-to-have items. Nice to have list: - Hands-on experience with FedRAMP 20x, Key Security Indicators, or automated compliance pipelines - Experience selling into government or higher ed, including GovRAMP or state procurement - Eligibility to work on federal systems, or an active or past clearance - Experience with Vanta, Jamf, Google Cloud, AWS, Cloudflare Zero Trust, and Pulumi or Terraform We'll put each as
          • . Skills: maybe we can extract specific skills from responsibilities: GCP, IAM, etc. But we already have many in requirements. Could create a Skills section for technical skills: GCP, IAM, org policies, network controls, logging, threat detection, infrastructure-as-code (Terraform/Pulumi), secrets management, credential rotation, secure development practices, penetration testing, vulnerability disclosure, AI safety, SSO, MFA, role-based access, endpoint security, Mac fleet management, onboarding/offboarding, security awareness, physical security systems, access control, cameras, alarms, visitor management, AI/LLM agent systems, PR scanning, IaC scanning, agentic workflows, AI system security, prompt injection defenses, sandboxing, audit logging, data handling, AI security tooling evaluation, guardrails for AI usage, SOC 2, continuous monitoring, FedRAMP, GovRAMP, NIST 800-53/800-171, ISO 27001, incident response planning, runbooks, tabletop exercises. But we risk inventing detail not explicitly listed? Many are explicitly mentioned in responsibilities. It's okay to list them as skills. However we must not invent or summarize away detail. Listing them as separate items is essentially extracting from text, not inventing. Should be okay. But we already have many details in responsibilities and requirements. Adding a Skills section may be redundant but allowed. The instruction: "Prefer a few substantive sections over many thin ones." So maybe we should not create a Skills section if we already have Requirements and Responsibilities covering. We could omit Skills. Benefits: from Compensation & Benefits: list: - 170,000–220,000 base salary, plus equity - 100% employer-paid Medical, Dental, and Vision; 75% dependent coverage - 401(k) with employer matching - Daily team dinner provided in-office - A small, mission-driven team changing how the world learns We need Pay section for salary? The instruction includes Pay as a possible heading. We could put salary under Pay section. Benefits under Benefits section. But we could also combine. Since they said "Pre