Security & AI Governance Lead​/Remote Equity

At Tribe, we’re on a mission to help enterprises realize the value of AI for their business. Every large enterprise wants to use AI to transform how they operate — but many don’t have the capabilities to do it. That gap is our opportunity.

We’re an AI-native services company that helps enterprises build and deploy best-in-class AI products that deliver real business impact. We partner closely with OpenAI and Anthropic, giving us rare visibility into the most advanced models, roadmaps, and GTM strategies in the world.

Enterprise AI runs on trust. Tribe’s teams work inside client environments, with client code, data, infrastructure, and systems. Before we can build, enterprise security teams need precise answers:
What can our engineers access? Which tools process their data? What is logged or prevented? How are AI systems governed? Who is accountable when something goes wrong?

We have a strong foundation, including SOC 2 Type II, enterprise security assessments, a public Trust Center, and experience delivering in regulated environments. As the volume and sophistication of our work grows, we need a dedicated leader to make that posture systematic, measurable, and consistently defensible.

As Security and AI Governance Lead, you’ll report to the CTO and own Tribe’s corporate security, compliance program, AI governance, and client-facing security work. This is not a policy-only or back-office role. You’ll build controls, lead difficult customer reviews, handle incidents, interrogate architectures and data flows, and help our teams ship securely without smothering them in process.

When the facts are distributed across Engineering, IT, Legal, and Delivery, you own the answer. You’ll identify the right evidence owners, validate the underlying facts, resolve inconsistencies, and package the result into a clear, credible response. You’ll be highly hands-on today and build the systems, and specialist partnerships Tribe needs as we scale.

Customer Trust & Compliance

Lead enterprise security reviews, questionnaires, diligence, and escalations—giving precise answers about current controls, planned improvements, and how identified gaps are being managed.

Own Tribe’s SOC 2 program and future certifications, along with the Trust Center, evidence library, and reusable customer security package.

Partner with GTM, Legal, and Delivery to remove legitimate security blockers while managing vendor risk, subprocessors, data retention, and sustainable customer commitments.

Security Program & Operations

Own Tribe’s security roadmap, risk register, policies, exceptions, metrics, and executive reporting.

Establish and continuously improve controls across identity, SSO and MFA, access lifecycle, MDM, EDR, encryption, DLP, patching, BYOD, vulnerability management, logging, and SIEM.

Own incident readiness and response, including severity decisions, cross-functional coordination, client communication, tabletop exercises, postmortems, and durable remediation.

AI & Secure Delivery

Define governance for coding agents, AI assistants, model providers, and subprocessors—including approved accounts, data flows, retention, telemetry, and human oversight.

Partner with Forward Deployed Architects and infrastructure leads on architecture reviews, threat modeling, secure SDLC, authentication, client segmentation, observability, and production readiness.

Turn recurring customer requirements and delivery lessons into reusable controls and patterns while determining what Tribe should build, automate, outsource, or support with dedicated hires.

You have 8+ years in security and have built or substantially improved an enterprise security and GRC program spanning identity, endpoints, data protection, monitoring, vendor risk, and incident response.

You have personally led demanding security reviews, questionnaires, diligence sessions, and escalations with large enterprise customers.

You have pragmatic technical depth: you can interrogate an architecture, trace a data flow, challenge an implementation, and determine what evidence would prove a control.

You have owned a SOC 2 or ISO 27001 cycle from control design and…