Security & AI Governance Lead
tribe-ai · United States ·
- Work mode
- Remote
- Seniority
- Lead
- Experience
- 8+ years
- Company size
- 11-50
- Salary
- USD 260,000 – 300,000 / year
tribe-ai · United States ·
State Street · Quincy, Massachusetts
State Street · Krakow, Poland
o9solutions · Bangalore, Karnataka, India
Robots and Pencils · US Remote
Leads security and AI governance for an AI services company, ensuring enterprise clients’ systems are trustworthy, compliant, and securely deployed while scaling controls and incident response.
At Tribe, we’re on a mission to help enterprises realize the value of AI for their business. Every large enterprise wants to use AI to transform how they operate — but many don’t have the capabilities to do it. That gap is our opportunity.
We’re an AI-native services company that helps enterprises build and deploy best-in-class AI products that deliver real business impact. We partner closely with OpenAI and Anthropic, giving us rare visibility into the most advanced models, roadmaps, and GTM strategies in the world.
Enterprise AI runs on trust. Tribe’s teams work inside client environments, with client code, data, infrastructure, and systems. Before we can build, enterprise security teams need precise answers: What can our engineers access? Which tools process their data? What is logged or prevented? How are AI systems governed? Who is accountable when something goes wrong?
We have a strong foundation, including SOC 2 Type II, enterprise security assessments, a public Trust Center, and experience delivering in regulated environments. As the volume and sophistication of our work grows, we need a dedicated leader to make that posture systematic, measurable, and consistently defensible.
As Security and AI Governance Lead, you’ll report to the CTO and own Tribe’s corporate security, compliance program, AI governance, and client-facing security work. This is not a policy-only or back-office role. You’ll build controls, lead difficult customer reviews, handle incidents, interrogate architectures and data flows, and help our teams ship securely without smothering them in process.
When the facts are distributed across Engineering, IT, Legal, and Delivery, you own the answer. You’ll identify the right evidence owners, validate the underlying facts, resolve inconsistencies, and package the result into a clear, credible response. You’ll be highly hands-on today and build the systems, and specialist partnerships Tribe needs as we scale.
Customer Trust & Compliance
Lead enterprise security reviews, questionnaires, diligence, and escalations—giving precise answers about current controls, planned improvements, and how identified gaps are being managed.
Own Tribe’s SOC 2 program and future certifications, along with the Trust Center, evidence library, and reusable customer security package.
Partner with GTM, Legal, and Delivery to remove legitimate security blockers while managing vendor risk, subprocessors, data retention, and sustainable customer commitments.
Security Program & Operations
Own Tribe’s security roadmap, risk register, policies, exceptions, metrics, and executive reporting.
Establish and continuously improve controls across identity, SSO and MFA, access lifecycle, MDM, EDR, encryption, DLP, patching, BYOD, vulnerability management, logging, and SIEM.
Own incident readiness and response, including severity decisions, cross-functional coordination, client communication, tabletop exercises, postmortems, and durable remediation.
AI & Secure Delivery
Define governance for coding agents, AI assistants, model providers, and subprocessors—including approved accounts, data flows, retention, telemetry, and human oversight.
Partner with Forward Deployed Architects and infrastructure leads on architecture reviews, threat modeling, secure SDLC, authentication, client segmentation, observability, and production readiness.
Turn recurring customer requirements and delivery lessons into reusable controls and patterns while determining what Tribe should build, automate, outsource, or support with dedicated hires.
You have 8+ years in security and have built or substantially improved an enterprise security and GRC program spanning identity, endpoints, data protection, monitoring, vendor risk, and incident response.
You have personally led demanding security reviews, questionnaires, diligence sessions, and escalations with large enterprise customers.
You have pragmatic technical depth: you can interrogate an architecture, trace a data flow, challenge an implementation, and determine what evidence would prove a control.
You have owned a SOC 2 or ISO 27001 cycle from control design and scope through audit and remediation.
You are credible and precise under pressure, distinguishing confirmed facts from assumptions, current controls from roadmap items, and meaningful risk from security theater.
You bring high agency and sound judgment, moving comfortably between strategy and execution while protecting the business without becoming a bottleneck.
Nice to Have
Experience securing AI or ML systems, including model providers, agentic workflows, telemetry, evaluations, and emerging AI-specific risks.
Experience in an AI-native services, consulting, or forward-deployed engineering environment
Impact: Ship AI systems that don’t just demo well but run at scale in Fortune 500 enterprises.
Growth: Stay hands-on with cutting-edge frameworks while developing field-tested instincts.
Variety: Solve problems across industries, from finance to healthcare to defense.
Culture: Work in a team that prizes resilience, creativity, and winning over process.
Trajectory: Build both your technical and consulting muscles in one of the most demanding roles in AI delivery.
sunset · New York