The posting
About Formation Bio
Formation Bio is a tech and AI driven pharma company differentiated by radically more efficient drug development.
Advancements in AI and drug discovery are creating more candidate drugs than the industry can progress because of the high cost and time of clinical trials. Recognizing that this development bottleneck may ultimately limit the number of new medicines that can reach patients, Formation Bio, founded in 2016 as TrialSpark Inc., has built technology platforms, processes, and capabilities to accelerate all aspects of drug development and clinical trials. Formation Bio partners, acquires, or in-licenses drugs from pharma companies, research organizations, and biotechs to develop programs past clinical proof of concept and beyond, ultimately helping to bring new medicines to patients. The company is backed by investors across pharma and tech, including a16z, Sequoia, Sanofi, Thrive Capital, John Doerr, Spark Capital, SV Angel Growth, and others.
You can read more at the following links:
- Our Vision for AI in Pharma
- Our Current Drug Portfolio
- Our Technology & Platform
At Formation Bio, our values are the driving force behind our mission to revolutionize the pharma industry. Every team and individual at the company shares these same values, and every team and individual plays a key part in our mission to bring new treatments to patients faster and more efficiently.
About this Role & Why it Matters
You will lead security, reporting to the Director of Technical Operations and working closely with the CTO’s organization. You will stay hands-on across data, cloud, application, and corporate security, lead incident response, and build and manage a small security engineering team. You will join the on-call rotation and use AI tools daily to build and maintain your work.
Security at Formation Bio protects clinical and patient data, the AI systems we build, and the applications our teams create every day. We are building an AI-native company, so security here is an engineering partnership, not a gate.
Key Responsibilities
- Lead incident response end to end, from triage and severity calls through containment, recovery, stakeholder communication, and post-incident reviews, and follow corrective actions through to closure. Join the on-call rotation, with the Director of Technical Operations as escalation.
- Stay hands-on in data, cloud (AWS and GCP), application, and corporate security, reviewing architecture, configuration, code, and pipelines with engineering teams and helping push fixes through to completion.
- Own data security for regulated clinical and patient data and for data used by AI systems, including access, classification, handling, and sharing controls.
- Secure our AI platform and agentic workflows: agent and service identity, credential and secrets handling, MCP connectors and tool permissions, and guardrails for AI agents that act on data and systems.
- Set guardrails and review paths for citizen-built applications so builders keep moving while risk stays managed.
- Operate and tune SIEM, EDR, and vulnerability management, and keep alerting and paging sustainable for an on-call team.
- Use AI tools to build and maintain detection, triage, and security automation, and hold that work to the same review and testing standards as code.
- Verify that controls work through detection tests, tabletop exercises, and assessments, and confirm fixes before closing findings.
- Run a risk-based security roadmap and lead security projects from scoping through delivery.
- Manage the security tooling and services budget, renewals, and vendor performance, and report to the Director and CTO each quarter on posture, material risks, and decisions needed.
- Keep governance lightweight and practical (risk register, policies, exceptions, AI governance), with controls and automated evidence that support GxP, HIPAA, and 21 CFR Part 11 obligations and make audit readiness routine.
- Partner with engineering, Enterprise AI, infrastructure, IT, and CSV as a technical peer, and drive security awareness using observed risks and incidents.
- Hire, coach, and manage security engineers with clear expectations, documented development plans, and growth paths.
Qualifications
Required
- 5+ years in security engineering or security operations, with hands-on depth in data, cloud, and application security.
- Led incident response to resolution and made independent severity calls under pressure.
- Reads and writes code and has partnered with engineers on secure design, remediation, and pipeline security.
- Uses AI tools daily and understands how to secure AI-enabled systems.
- Hands-on with SIEM, EDR, vulnerability management, and security automation.
- Has owned security tooling, budget, and vendor relationships.
Preferred
- Direct people-management experience, including feedback, development, and hiring.
- Experience with agentic identity and security, MCP integrations, or citizen-built application governance.
- Regulated-industry experience (life sciences, healthcare, fintech).
- Familiarity with HIPAA, GxP, and 21 CFR Part 11.
Who We Are Looking For
You are a builder at heart. You keep scope large and teams small, earn engineers’ trust through technical depth, and challenge assumptions with evidence. You use AI as a baseline in your own work and can secure the agentic systems and citizen-built applications our teams are creating. You are comfortable writing the playbook as you go, and you want to show that pharma can run on a modern, tech-first security culture.
What Success Looks Like
First 30 days
- Learn the environment: regulated data flows, the AI platform and agent workflows, citizen-built applications, cloud accounts, and current controls and tooling.
- Join the on-call rotation and validate escalation paths.
- Complete a gap analysis across data, cloud, application, and corporate security covering open risks, control gaps, and audit readiness.
- Prioritize the security work and agree on the roadmap with the Director.
At 3 months
- Baseline detection coverage, response time, vulnerability remediation, and control health, and tune alerting so on-call is sustainable.
- Ship the first high-priority fixes from the gap analysis with engineering teams, with emphasis on data security and cloud infrastructure.
- Ensure material control gaps have accountable owners and timelines.
- Run a tabletop exercise and the first round of control verification tests.
- Establish operating cadences for stakeholder communication, risk tracking, and quarterly reporting.
At 6 months
- Lead security incidents and routine operational decisions independently, with clear escalation of material business, legal, or regulatory risks.
- Show measurable improvement against the 90-day baselines in detection coverage, response performance, and vulnerability remediation.
- Make audit and assessment readiness a sustained operating practice with less last-minute effort and clearer evidence ownership.
- Have AI-assisted security automation in production that reduces manual work, with guardrails in place for agentic identity, MCP connectors, and citizen-built applications.
- Ensure every direct report has clear expectations and a documented development plan.
Total Compensation Range: $185,500 - $232,000
Compensation Individual compensation is determined by several factors, including role scope, geographic location, and skills & experience. Your offer will reflect where you fall within the range based on these considerations. In addition to base salary, we offer equity, comprehensive benefits, and generous perks. If the posted range doesn't match your expectations, we still encourage you to apply!
Where We Hire Formation Bio is prioritizing hiring in key hubs, primarily the New York City and Boston metro areas, with a hybrid model requiring 3 days per week in office. Applicants from the Research Triangle (NC) and San Francisco Bay Area may also be considered. Please apply only if you reside in these locations or are willing to relocate.
Equal Opportunity Formation Bio is committed to building a diverse and inclusive team. We are an equal opportunity employer and welcome candidates from all backgrounds. All qualified applicants will receive consideration for employment without regard to race, color, creed, religion, national origin, ancestry, sex (including pregnancy, childbirth, breastfeeding, and related medical conditions), gender identity or expression, sexual orientation, age, disability, genetic information, marital status, military or veteran status, or any other characteristic protected by federal, state, or local law.
We've seen a rise in recruiting impersonation scams across the industry, where fake profiles pose as recruiters aiming to trick candidates into sharing personal and financial information through illegitimate interviews and job offers. All legitimate recruiting communications from Formation Bio will come from a @formation.bio email address. If you receive outreach from someone claiming to work at Formation Bio through any other domain or channel, please disregard it and do not share any personal information.
