Security Lead - m​/f​/d

Help Us Change the Way the World Works Build something that matters.

Langdock exists to change the way the world works, bridging the gap between what technology can do and what people actually do with it. We bring all leading AI models into one secure, model-agnostic platform and make them usable across entire organizations. Over 10,000 companies use our platform every day, from fast-growing startups to some of Europe's largest enterprises. Their employees open Langdock to draft strategies, analyze documents, or automate workflows - helping them to work smarter, think more creatively, and reach their full potential.

We're hiring a hands‑on Security Lead to own security at Langdock across all surfaces. Not just the management system, but the actual security of our identities, devices, premises, and processes.

This is a broad ownership role, deliberately scoped for one ambitious person. We believe that with good automation and an AI‑first way of working, one person can run what traditionally takes a small team: the certified ISMS, identity and access management, device management, security programs like bug bounty, and physical security. You'll use automation (and Langdock itself) aggressively to keep the operational load low and the bar high.

You'll design technical and organizational controls that enable us to run our business securely and that actually make sense for how we build and operate. You'll also make sure we can prove they work, quarter after quarter, audit after audit.

You'll work closely with engineering, operations, and sales by translating security and compliance requirements into controls people can realistically implement and maintain, and explaining our security posture to customers who consider Langdock.

• Own identity & access.

  • Own identity and access management across all our identity surfaces. Build and automate the processes for onboarding, offboarding, and privilege provisioning so the right people have the right access at the right time, and nothing more.

  • Properly configure and own our Entra . Conditional access, group and role design, lifecycle automation, and integration with the tools our teams actually use.

• Own devices.

  • Own MDM and device management. Ensure every device that touches company data is enrolled, encrypted, patched, and recoverable with as little friction for the team as possible.

  • Own the device inventory. Keep an accurate, automated picture of what hardware exists, who has it, and what state it's in.

• Own security programs.

  • Run our bug bounty and security programs. Set up and operate responsible disclosure / bug bounty, triage findings, and drive them to resolution with engineering.

  • Own physical security of our premises. Access control, visitor handling, and the physical controls our certifications and customers expect.

• Own the ISMS.

  • Own the information security management system. Maintain and continuously improve our ISO 27001 and SOC 2 Type II certified management system, ensuring it reflects how Langdock actually operates, not just how a framework says it should.

  • Design controls, not paperwork. Define technical and organizational safety measures that are proportionate, practical, and genuinely reduce risk.

  • Manage the risk register. Identify, assess, prioritize, and track information security risks; drive risk treatment plans to closure with the relevant owners.

  • Maintain evidence in Vanta. Keep our control evidence current and audit‑ready on an ongoing basis.

  • Run audits & new standards. Manage the end‑to‑end audit process for existing certifications (ISO 27001, SOC 2 Type II) and lead scoping and readiness for new standards as the business requires (e.g. C5, TISAX, HDS, FedRAMP‑adjacent requirements, customer‑specific frameworks).

• Partner across the company.

  • Partner with engineering, operations, sales. Sit close to the teams that build and run the product; help them implement controls in ways that fit into existing workflows (CI/CD, infrastructure, access management) rather than bolting security on afterward.

  • Respond to customer and prospect security questions
    , including security questionnaires and due‑diligence requests, as needed.

  • Automate…