Manager, Security
Formationbio · New York, NY; Boston, MA
About this role
**Manager, Security — Formation Bio** **About Formation Bio** Formation Bio is a tech and AI-driven pharma company differentiated by radically more efficient drug development. By accelerating drug discovery and clinical trials, the company helps bring new medicines to patients faster and more efficiently. **About this Role & Why it Matters** You will lead security, reporting to the Director of Technical Operations and working closely with the CTO’s organization. You’ll stay hands-on across data, cloud, application, and corporate security; lead incident response; build and manage a small security engineering team; join the on-call rotation; and use AI tools daily to build and maintain your work. Security at Formation Bio protects clinical and patient data, the AI systems the company builds, and the applications teams create every day. Security is an engineering partnership—not a gate. --- ## Key Responsibilities - Lead incident response end to end (triage/severity calls → containment/recovery → stakeholder communication → post-incident reviews) and ensure corrective actions close out. - Join the on-call rotation; escalate with the Director of Technical Operations. - Stay hands-on across data, cloud (AWS and GCP), application, and corporate security—review architecture, configuration, code, and pipelines with engineering teams and drive fixes to completion. - Own data security for regulated clinical and patient data and for data used by AI systems (access, classification, handling, and sharing controls). - Secure the AI platform and agentic workflows (agent/service identity, credential & secrets handling, MCP connectors/tool permissions, and guardrails for AI agents acting on data/systems). - Set guardrails and review paths for citizen-built applications so builders can move quickly while risk stays managed. - Operate and tune SIEM, EDR, and vulnerability management; keep alerting/paging sustainable for an on-call team. - Use AI tools to build and maintain detection, triage, and security automation—holding that work to the same review/testing standards as code. - Verify controls work via detection tests, tabletop exercises, and assessments; confirm fixes before closing findings. - Run a risk-based security roadmap and lead security projects from scoping through delivery. - Manage security tooling/services budget, renewals, and vendor performance; report quarterly on posture, material risks, and decisions needed. - Keep governance lightweight and practical (risk register, policies, exceptions, AI governance) with automated evidence supporting **GxP, HIPAA, and 21 CFR Part 11** obligations and routine audit readiness. - Partner with engineering, Enterprise AI, infrastructure, IT, and CSV as a technical peer; drive security awareness using observed risks/incidents. - Hire, coach, and manage security engineers with clear expectations, documented development plans, and growth paths. --- ## Qualifications **Required** - 5+ years in security engineering or security operations, with hands-on depth in data, cloud, and application security. - Led incident response to resolution; made independent severity calls under pressure. - Reads/writes code and has partnered with engineers on secure design, remediation, and pipeline security. - Uses AI tools daily and understands how to secure AI-enabled systems. - Hands-on with SIEM, EDR, vulnerability management, and security automation. - Owned security tooling, budget, and vendor relationships. **P
Listing freshness
CronJobs last confirmed this listing 1h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.