Requirements 7+ years in security, with 3+ years in a regulated setting (HIPAA, finance, or government), must be evidenced in bullets, not just worked at a healthcare company.

Operational HITRUST or SOC2 experience - managed/maintained an ongoing program, not just audit participation or a one-time certification push.

Structured risk quantification to non-technical leadership (documented cost vs risk recommendations, not just identified risks).

Built or significantly improved security infrastructure in a cloud-native environment (GCP, AWS, or Azure).

Track record evaluating and managing external security vendors/consultants (scoping, risk assessment, delivery accountability).

Direct hands-on AI/LLM security work - assessing risk in an AI product, governing internal LLM tool usage, or building controls for LLM systems.

Evidenced cost vs risk judgment - a recommended against decision or documented tradeoff, not just risk-averse defaults.

Comfortable as a solo IC with no team to delegate to - recent hands-on security work, not pure people-management.

📌 Security Lead Engineer (Bengaluru)
🏢 GTMfund
📍 Bengaluru