Director of Security
Prophecy · San Francisco
About Prophecy
The leader in AI-native data preparation and analysis, Prophecy is revolutionizing how the world's top enterprises turn data chaos into reliable insights. We introduce the AI-native data lifecycle (generate, refine, deploy) where our industry-leading AI agents and humans work hand-in-hand in visual and document interfaces to analyze, transform, and prepare data to ship trusted insights at enterprise scale. Join us as we build the next data revolution.
About The Role
Prophecy is entrusted by some of the world's largest organizations, including leading banks and telecoms, to handle sensitive, business-critical data. We've built a strong security foundation to earn that trust, including ISO/IEC 27001:2022 certification and SOC 1 Type II and SOC 2 Type II reports, and now we're hiring our first dedicated security leader to take it to the next level, especially as AI agents become central to how our customers work with their data.
You'll own security end-to-end and lead a small team of security engineers and IT staff as a player-coach: setting strategy while doing much of the hands-on work yourself. You will be responsible for product and AI security, cloud and infrastructure security, compliance, and customer trust, along with the corporate security strategy that supports them. You'll partner closely with our engineering teams across the US and India, and with our go-to-market team as they sell into some of the world's most security-conscious enterprises. This role reports directly to the CTO.
Responsibilities
Security Strategy and Program
- Own Prophecy's security strategy and roadmap across product, cloud infrastructure, and corporate environments.
- Build and scale the security program, including policies, controls, risk assessments, and a clear view of where to mitigate risk and where to accept it.
Product Security
- Partner with Engineering across the US and India to embed security into how we design, build, and ship our AI agents and data platform.
- Own threat modeling for agentic systems, including tool and permission scoping, prompt injection defenses, credential handling, data isolation between customers, and runtime monitoring.
- Lead AI governance for our agent platform, building on our alignment with the EU AI Act and NIST frameworks, including how customer data flows through models and third-party LLM providers.
- Lead application security practices across secure code review, vulnerability management, penetration testing, and secure-by-default engineering standards.
- Secure our integrations with Databricks, Snowflake, BigQuery, and other customer data platforms.
Internal AI Agent Security
- Set guardrails for the agents we run internally: least-privilege access to data, systems, and MCP servers, short-lived credentials, and human approval for high-risk actions.
- Review new internal agents and AI tools before they touch production or customer data, set policy for employee AI use, and extend logging and incident response to agent activity.
- Build agents for the security team itself, such as questionnaire automation and alert triage.
Cloud and Infrastructure Security
- Own the security posture of our AWS and Kubernetes environments, including identity and access management, secrets management, logging, and detection.
- Build and run incident response, from detection and triage through post-incident review and remediation.
Compliance and Customer Trust
- Own and evolve our compliance programs, including ISO/IEC 27001:2022, SOC 1 Type II, and SOC 2 Type II, maintaining continuous audit readiness and expanding coverage as the business requires.
- Own data privacy compliance across the regions where we operate, including GDPR, CCPA, and India's DPDP Act.
- Lead security reviews, questionnaires, and trust documentation for enterprise and regulated-industry customers.
- Join customer calls with CISOs and security teams to answer hard questions directly and help close deals.
Corporate Security
- Partner with IT and People on access management, device security, vendor risk, and security awareness across the company.
Requirements
Required
- 10+ years in security, with at least 3 years in product, application, or cloud security at a software company.
- Led a small security or IT team as a player-coach.
- Hands-on experience securing AWS and Kubernetes environments.
- Experience owning ISO/IEC 27001 and/or SOC 2 Type II programs, including audits and ongoing control management.
- Experience supporting enterprise sales through security reviews, questionnaires, and customer CISO conversations.
- Comfortable being both strategist and hands-on practitioner as the first dedicated security leader at a fast-growing startup.
- Strong written and verbal communication, including translating technical risk for executives and customers.
Preferred
- Experience securing AI/LLM-powered products, including prompt injection, agent permissioning, and data handling with third-party model providers.
- Background at a data platform or data infrastructure company (Databricks, Snowflake, dbt, Fivetran, or similar).
- Experience selling into regulated industries such as financial services, healthcare, or telecom.
- Experience working with distributed engineering teams across time zones.
Benefits and Perks
- Prophecy covers 99% of employee health insurance premiums and 75% for dependents
- Discretionary allowance for cell phone, wifi, gym memberships, wellness, and more
- Flexible PTO
- Professional development allowance
- Company sponsored Long Term Disability and Life Insurance, FSA/HSA, dental, vision
- Ability to have your fingerprint on an innovative product
- End-to-end ownership of your projects
*Benefits and perks may vary per country
Our Commitment to Diversity and Inclusion
At Prophecy, we are committed to fostering a diverse and inclusive culture where everyone can excel. We take great care to ensure that our hiring practices are inclusive and meet equal employment opportunity standards. Individuals looking for employment at Prophecy are considered without regard to age, color, disability, ethnicity, family or marital status, gender identity or expression, language, political affiliation, race, religion, sexual orientation, socio-economic status, and any other protected characteristics.