Head of Information Security & IT

Chronograph was founded to bring next-generation technology to private capital markets. Through our suite of cloud-based analytics and data management solutions, we help many of the world's largest and most sophisticated venture capital, private equity, and credit funds understand their investment performance in unprecedented detail, with over 258,000 private companies and 15,000 private capital funds monitored via our solution suite.

At Chronograph, we get to go  behind the scenes  and work directly with investors who are driving some of the most impactful changes across high growth start-ups, global infrastructure and renewable energy, growth equity, and all other private capital strategies. The firm is backed by Sixth Street Growth, Summit Partners, Carlyle Alp Invest, and Nasdaq Inc., and has seen continuous rapid growth since its founding in 2016.

Our client base today includes hundreds of investors and asset managers monitoring more than $5.9 trillion in invested capital with 8 of the 10 largest GPs and 5 of the 10 largest LPs using Chronograph.

Bring your expertise to a highly collaborative, creative, and innovative team with a market-leading technology product suite. We hire technologists with a broad set of technical skills who are eager to solve a wide range of challenges. The thread that unites us at Chronograph is a focus on delivering great, secure products that drive value for our clients.

We are looking for a Head of Information Security & IT to own Chronograph's security strategy, architecture, and execution as we continue to scale.

This is a hands-on leadership role spanning security strategy, governance, technical execution, and external assurance. We expect you to continuously strengthen our information security program and certifications while remaining technically close enough to investigate issues, prototype solutions, and implement controls where appropriate.

The security landscape is changing rapidly, particularly as AI expands both attacker capabilities and the attack surface of modern software. We want someone who follows emerging threats closely, continuously reassesses whether our security posture remains appropriate, and responds to credible new threats with urgency.

Our ideal candidate has a strong sense of ownership, excellent judgment, and a bias toward action. You are equally comfortable defining security strategy, representing it with sophisticated clients and external stakeholders, and getting technically involved when that is the best way to move an issue forward.

• Own Chronograph's information security program, strategy, architecture, and roadmap
• Serve as Chronograph's senior security leader in strategic client, partner, and external engagements
• Lead and mentor a small team of senior security, compliance, and IT practitioners
• Continuously assess our security posture and prioritize pragmatic, high-impact improvements
• Communicate material security risks, priorities, and tradeoffs clearly to executive leadership
• Develop a deep understanding of the business, product, and infrastructure to make sound security decisions

• Develop technical approaches for security initiatives, validate assumptions, and build proofs of concept where useful
• Implement security controls directly where appropriate, while partnering with engineering and infrastructure teams on more complex efforts
• Maintain sufficient technical depth across cloud, application architecture, identity, logging, and security tooling to investigate issues and guide implementation
• Evaluate and configure security tooling and automation
• Own the security posture and requirements for our cloud and application environments, partnering with infrastructure and engineering teams on implementation
• Lead vulnerability management and threat modeling programs, hands-on where needed
• Partner with engineering on secure development practices and application security architecture
• Own and improve application security tooling, including SAST, SCA, DAST, SOAR, secrets detection, and infrastructure-as-code scanning
• Prioritize vulnerabilities based on exploitability and business risk

• Own security strategy for Chronograph's use of AI internally and within our products
• Secure employee use of AI tools, agents, models, and integrations, including controls around sensitive data, third-party services, and agent permissions
• Threat-model AI-enabled functionality, including prompt injection, data exfiltration, insecure tool use, excessive agency, and supply-chain risks
• Track developments in offensive and defensive AI security and quickly assess their relevance to Chronograph
• Evaluate AI-enabled security tooling and automation where it can improve our defensive capabilities

• Own our detection and response stack, including SIEM, EDR, WAF, and DLP, as well as the automation routing alerts between them
• Lead threat detection and incident response…