VP, Security

The Role

We're hiring a VP of Security to own security at Engine end to end: strategy, engineering, operations, and the trust posture that carries us through future funding and beyond. This is not a maintain-the-program role. The program is healthy: clean SOC 2 and PCI audits, established AppSec, SecOps, and CloudSec functions, modern tooling across the stack. The mandate is to build what comes next.

What comes next is AI. Agents inheriting human credentials in cloud environments with real access sprawl. Prompt injection and data exfiltration attempts against customer-facing AI surfaces. Shadow AI usage across every function of the business. Non-engineers shipping AI-built software that never touches a review path. Adversaries using the same models we do, at machine speed. We need a leader who sees this wave clearly, has strong conviction about what to build, and can stand up net-new AI security capability while keeping the fundamentals sharp.

This role reports directly to the SVP of Engineering and AI and operates as a peer to senior engineering leadership. You'll represent security to the executive team, the board, and enterprise customers.

What You'll Own

• AI Security (the priority). Stand up our AI security function from approved headcount. Build the internal AI gateway: single controlled egress for all internal AI usage, with authN, per-tool authZ, central prompt and output logging, inline DLP, and model allowlisting that discovers and absorbs shadow AI. Define agent identity in AWS so agents get scoped roles and short-lived credentials, never inherited human permissions. Harden consumer-facing AI surfaces: authenticated MCP with gateway-enforced per-tool authorization, a bad-prompt detection pipeline feeding the SIEM, output filtering on sensitive fields, and a red team scenario suite that runs as CI regression on every AI surface.
• Security Engineering. Lead AppSec and SecArch, SecOps, and CloudSec, roughly ten people at full staffing across the current team and approved reqs, plus the corporate IT function. Drive the roadmap already in motion: secure-by-design intake, secrets refactoring, org-wide RBAC mapped to Okta groups, detection engineering on our next-gen SIEM, automated response playbooks, and identity log onboarding across Okta, Salesforce, and AWS.
• GTM and Operations Security. Harden how the business operates: Salesforce least privilege, contractor and BPO access through VDI on managed hardware, insider threat monitoring, and production data hygiene.
• Enterprise Trust and Series D Readiness. Own the security narrative for fundraising diligence and enterprise sales. Run point on customer security reviews and build the trust artifacts that shorten enterprise deals. Own the technical controls behind SOC 2 and PCI in close partnership with our legal team, which owns compliance, privacy, and audit programs.
• Corporate IT. Own identity, endpoint fleet, and SaaS administration. Our Okta unification work makes identity the connective tissue between security and IT, and this role owns both sides of it: joiner-mover-leaver automation, entitlement hygiene, and a managed environment that holds up as agents become first-class users of our systems.

What Success Looks Like in Year One

• AI security team hired and shipping: internal AI gateway live, agent identity model enforced ahead of broad agent rollout, prompt abuse pipeline running in production
• security diligence and a customer-facing trust posture that accelerates enterprise deals rather than slowing them
• RBAC, secrets remediation, and JML automation moving access from person-accumulated to role-driven
• SOC 2 and PCI technical controls sustained without heroics, with a crisp operating boundary established with legal's compliance and privacy function
• A security org that engineering wants to work with: gates that block only when the issue is real and the fix is clear

Who You Are

• 12+ years in security with 5+ leading security organizations, ideally through hypergrowth and a major fundraise or IPO-track diligence process
• Deep technical credibility: you can whiteboard an agent identity model, argue the details of an AI gateway architecture, and review a detection engineering backlog without a translator
• Genuine, current conviction about AI security. You've thought hard about prompt injection, agentic access, model-mediated data exfiltration, and LLM red teaming, and you have opinions about what actually works
• Builder of net-new functions, not just an operator of mature ones. You've taken a domain from zero headcount to a working team with real controls
• Fluent in cloud-native security: AWS identity, CSPM, EDR and SIEM operations, modern AppSec tooling in CI
• Comfortable owning corporate IT: identity platforms, endpoint fleets, and SaaS governance as extensions of the security mission, not a side duty
• Executive presence: you can brief a board, close an enterprise customer's security review, and tell leadership no with a better alternative attached
• Bias toward enablement. You believe security's job is to make the safe path the fast path, and you remove low-value controls as readily as you add high-value ones

Nice to Have

• Experience securing customer-facing AI or LLM products at scale
• Background in payments, travel, or another PCI-regulated, high-transaction-volume environment
• Experience partnering with legal on privacy programs and regulatory frameworks (GDPR, CCPA, emerging AI regulation)

Why This Role

Most VP of Security roles are about maturing what exists. This one is about defining how an AI-native company defends itself while the threat model is still being written. You'll inherit a clean foundation, approved headcount, executive air cover, and a company that treats AI as its operating model rather than a feature. Join us on this mission to reshape how businesses experience travel, and help build the security foundation every AI at Engine runs on.