Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 393 days ago

Head of Security & Compliance

gradientflo19 open roles

Pay
$12,000 – $24,000 a yearly
Where
Hyderābād, India
Work mode
On site
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowHead of Security & Compliancegradientflo · Hyderābād, India

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on gradientflo's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

12.3% of postings close within 7 days. Measured by our own scanner across the market.

Share of postings closed within
  1. 2.1%1 day
  2. 4.5%3 days
  3. 12.3%7 days
  4. 19.3%14 days
  5. 35.6%30 days
  6. 58.1%60 days
This job: posted 393 days ago

The posting

Role Overview

You will be the guardian of trust at Vibecoderz. Developers will only commit their code, data, and learning journeys into a platform they know is secure, private, and compliant. You’ll build Vibecoderz’ end-to-end security posture, ensure compliance with global frameworks (SOC 2, GDPR, ISO 27001), and proactively defend against threats like prompt injection, data poisoning, and model misuse.

This is not just about firewalls and audits. This is about making security invisible but unbreakable — so users feel flow, while knowing their data and code are safe.

Key Responsibilities

  1. Security Architecture Define and enforce Vibecoderz’ security-first architecture across all layers (frontend, backend, AI, infra). Design secure patterns for AI agent communication (A2A via Pub/Sub) to prevent leakage or injection attacks.
  2. Compliance & Certifications Lead Vibecoderz through SOC 2 Type II, GDPR, ISO 27001, HIPAA (where relevant). Own documentation, audits, and compliance playbooks.
  3. Application Security Implement secure coding standards, static/dynamic analysis pipelines, and dependency scanning. Run regular penetration testing and bug bounty programs.
  4. Cloud & Infrastructure Security Secure GCP stack (Cloud Run, Firestore, Pub/Sub, Cloud Tasks, Workflows). Manage IAM policies, VPC service controls, and secrets management.
  5. AI/LLM Security Develop guardrails for LLMs against prompt injection, malicious payloads, or unsafe content. Build continuous AI evals for hallucination, bias, and red-team attacks.
  6. Data Privacy & Governance Ensure secure handling of developer data, GitHub integrations, and learning graphs. Define data retention, anonymization, and encryption-at-rest/in-transit policies.
  7. Monitoring & Incident Response Build a Security Operations Center (SOC) playbook. Implement observability pipelines (OpenTelemetry + GCP Trace) for security events. Own incident response, from detection → containment → resolution.
  8. Cross-Functional Leadership Partner with CTO/DevOps to embed security into CI/CD. Partner with CPO/PM to balance UX speed with security tradeoffs. Mentor engineers on “security-as-craft” culture.

Success Metrics

90 Days (Probation):

  • Establish secure CI/CD pipelines with SAST/DAST checks.
  • Define and document Vibecoderz’ security baseline (policies, access, data handling).
  • Run the first red-team simulation against TutorAgent + artifacts.

12 Months:

  • Achieve SOC 2 Type II certification.
  • Maintain zero P1/P2 security breaches.
  • Achieve 99.99% uptime without security-related downtime.
  • Establish a continuous security monitoring dashboard visible to leadership.

Must-Haves

  • 10+ years in security engineering or compliance leadership in SaaS or developer platforms.
  • Proven success in achieving SOC 2 / ISO 27001 / GDPR compliance.
  • Strong background in cloud-native security (GCP preferred).
  • Expertise in application security, IAM, VPC, encryption, and key management.
  • Experience designing security frameworks for AI/LLM products.

Nice-to-Haves

  • Prior experience in developer-first SaaS.
  • Contributions to security open-source projects or standards.
  • Experience with federated identity, SSO, and enterprise compliance.
  • Background in offensive security / red-team practices.

Tech Stack Visibility

  • Infra & Cloud: GCP (Cloud Run, Firestore, Pub/Sub, Cloud Tasks, Workflows)
  • CI/CD Security: GitHub Actions, Snyk, Dependabot
  • Observability & Monitoring: OpenTelemetry, GCP Trace, SIEM tools
  • AI Security: LangSmith/Langfuse evals, custom LLM guardrails
  • Compliance: SOC 2, ISO 27001, GDPR frameworks
  • Identity & Access: Firebase Auth, IAM, VPC Service Controls
  • Encryption: KMS, TLS 1.3, AES-256

Assessment

Objective: Validate ability to design secure architecture + compliance strategy for Vibecoderz.

Assessment (3-Part):

  1. Security Design (Written) Draft a security architecture doc for Vibecoderz’ core flow: Text → Course → Artifact → Mini-App. Must include: Data encryption flow (at rest + in transit). Access control model (OAuth + Firebase Auth). AI guardrails (prompt injection, unsafe outputs). Threat modeling for Firestore + Pub/Sub.
  2. Compliance Playbook Outline a 12-month plan to achieve SOC 2 Type II certification. List top 5 risks for Vibecoderz’ compliance and your mitigation plan.
  3. Coding Assessment Implement a secure FastAPI microservice with: OAuth2 authentication. Rate limiting (per-user). Secure logging (PII masked). Deploy to Cloud Run with IAM policies. Deliver a Postman collection with working requests.

Deliverables:

  • Written security design doc (3–4 pages).
  • Compliance roadmap (slide deck or doc).
  • GitHub repo with code + deployment instructions.
From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against gradientflo's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on gradientflo's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    gradientflo's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.