• own all security outcomes: infrastructure, compliance, external programs, and internal security • drive execution and hold an extremely high bar for our security posture • hands-on role, independently build these programs from scratch • own SOC2 and data privacy compliance (audits, GDPR, CCPA) • own infrastructure security (AWS, Vercel, Cloudflare, PlanetScale - secrets, access controls, monitoring) • own security incident response (detection, triage, remediation, post-mortems) • own external security programs (bug bounty, pen tests, threat monitoring) • own internal security (IT vendor, device security, office security, training) • first line of escalation for all security issues