Chief Information Security Officer

Contexttl;dv helps revenue, customer, product and leadership teams turn meetings into structured intelligence. We record, transcribe, summarise and analyze meetings, so teams understand what's happening across sales demos, feedback calls, onboarding sessions and internal discussions.We're growing fast: revenue is up 5x and usage 10x over the last 12 months. As we move upmarket, enterprise customers are trusting us with some of their most sensitive data, which is their conversations. Security, privacy, and AI governance are now part of what we sell, not just a cost of doing business.The RoleWe're hiring our first full-time CISO. You'll own security and compliance at tl;dv end-to-end. This is a player-coach role. You'll set the strategy and also do a lot of the hands-on work yourself. As the program grows, you'll hire and lead a small security team. You'll also be the person customers and auditors talk to about security.You'll report to the CEO and work closely with the CTO, Engineering, Infra, Product, Sales, Legal and our DPO.Where things stand today: SOC 2 Type II is in place and audited annually. ISO 27001 is in progress. ISO 42001 hasn't started yet. We use Vanta for continuous compliance.What you'll ownSecurity EngineeringSet the AppSec and cloud security direction and get hands-on: threat modeling, secure SDLC, secure code review, SAST/DAST/SCA and secrets scanning in CI, and cloud hardening and posture management.Own vulnerability management end-to-end: intake, triage, severity, SLAs and verified fixes.Secure our AI/LLM stack, covering prompt injection, data leakage, model and vendor risk, and tenant isolation.Improve detection and logging so we find problems before customers do.Offensive Security & External ProgramsPlan and run our annual third-party penetration tests and any targeted tests (API, mobile, browser extension, AI features), and make sure findings actually get fixed.Own our Responsible/Coordinated Vulnerability Disclosure program (security.txt, safe harbor, triage SLAs).Launch and run a Bug Bounty program, including choosing the platform, scope, rewards and researcher relationships.Governance, Risk & ComplianceOwn our certification roadmap: keep SOC 2 Type II clean year over year, take us to ISO 27001 certification, and lead ISO 42001 (AI Management System) certification. We want to be one of the first meeting-AI companies to get there.Run a single integrated control set and ISMS/AIMS across all three frameworks: risk register, Statement of Applicability, internal audits, management reviews, and the auditor relationship.Own security policies, access reviews, security awareness training and third-party/vendor risk management.Work with our DPO on the security side of privacy: technical and organizational measures, security input to DPIAs, and sub-processor security reviews.Incident ResponseOwn the incident response plan, on-call playbooks and tabletop exercises. Lead security incidents end-to-end, including customer communications. When personal data is involved, work with the DPO on the 72-hour GDPR breach notification assessment.Customer TrustBe the security voice in enterprise deals: security questionnaires, security reviews, the security terms in contracts, and our Trust Center.Whom We Are Looking ForYou're a security leader who is also hands-on. You've built security and compliance programs at a high-growth B2B SaaS company. You're as comfortable in a threat model or a pull request as you are in front of an auditor or an enterprise CISO.Must-havesYou're a hacker at heart. You think like an attacker first. You've found and exploited real vulnerabilities yourself in web apps, APIs, cloud or auth flows, and can show it: CVEs, bug bounty hall-of-fame entries or rankings, CTF results, published research, conference talks, or open-source security tools.Deep, hands-on offensive and defensive skills. You can take apart an OAuth/SSO flow, chain an SSRF into cloud credential theft, break tenant isolation, or prompt-inject an LLM feature, and then design and ship the fix with engineering. You still write code (Python, Go, TypeScript or similar) and build your own tooling when nothing on the market fits.Engineer first, leader in the making. You're a security engineer good enough to earn instant respect from our developers, and you want to grow into the full CISO role: owning strategy, compliance and a team.5+ years in security, including 3+ as CISO, Head of Security, or a similar lead role at a SaaS company.You've personally led SOC 2 Type II and ISO 27001 certifications, not just contributed to them.Good working knowledge of GDPR and its security requirements (Art. 32, breach notification), enough to partner closely with our DPO.A real AppSec and cloud security background. You can read code, review architectures and weigh in on engineering trade-offs.Experience running pentests, vulnerability disclosure and/or bug bounty programs.You've led incident response for a real incident.You can explain security clearly to engineers, executives and customers, and you find a way to make things happen instead of just saying no.You're comfortable owning the whole area in a fast-moving startup with limited resources.You're a strong writer and do well in a remote, async-first team.Nice-to-havesExperience with ISO 42001, ISO 27001, the NIST AI RMF, or with securing LLM-based products.Experience with products that process sensitive content (recordings, transcripts, communications data).Hands-on experience with Vanta (or Drata/Secureframe), HackerOne/Intigriti/YesWeHack, and AWS/GCP security tooling.Certifications such as CISSP, CISM, CIPP/E, CIPM, OSCP or ISO 27001/42001 Lead Implementer/Auditor.Experience hiring and growing a small security team from the ground up.PracticalitiesType: Full-time

Location: Fully remoteWays of working: Async-first.

We default to written communication (docs, RFCs, recorded walkthroughs) and keep meetings for the moments that need them. You'll be comfortable writing clear security decisions and policies that people can act on without a call.Reports to: CEOWe really can't wait to hear from you! ✨