SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Kodex is a Series A security and compliance platform that helps organizations securely handle sensitive subpoenas and data requests from law enforcement and government agencies. Founded by a former FBI agent and backed by top-tier investors including Andreessen Horowitz, Y Combinator, Peak XV, and Thiel Capital, Kodex serves over 15,000 government agencies across 190 countries and is trusted by industry leaders like Coinbase, Stripe, and AT&T.
You will own the security program end-to-end as the company scales. This is a hands-on, zero-to-one operator role where you'll take over CorpSec, SecOps, and compliance responsibilities from the current lead and build out the practice across CloudSec and AppSec. You'll have high autonomy and real ownership of decisions that shape how a fast-growing Series A company protects itself and its customers.
Key responsibilities include:
- CorpSec & SecOps: Own detection, response, and prevention across the Mac-first environment. Run and refine the SentinelOne stack, phishing/email-security defense, and incident response playbooks.
- Compliance & Audit: Drive the SOC 2 / Vanta program and own the January–February audit cycle as the primary technical owner.
- Identity & Access: Own Okta, Google Workspace, and access-management guardrails, maintaining least-privilege enforcement as the company grows.
- Detection & Observability: Use Datadog and SentinelOne to close visibility gaps and build alerts and dashboards that surface real signal.
- Vendor & Third-Party Risk: Manage security reviews of vendors and integrations; keep Vanta accurate as the source of truth.
- Security Culture: Create clear documentation, practical training, and playbooks that the team actually uses.
Requirements:
- 4–6 years of security engineering experience, ideally at a startup or small company (< 200 people)
- Hands-on, zero-to-one operator experience building security programs from scratch and making independent judgment calls in ambiguity
- Mac-first environment experience, including Mac fleet security, MDM, and Apple-native tooling
- CorpSec + SecOps depth in detection engineering, incident response, phishing defense, and endpoint security
- SOC 2 audit experience (owned or contributed heavily to a cycle)
- Comfort with the stack: Datadog, SentinelOne, Okta, Google Workspace, Vanta, or close analogues
- Practical security thinking focused on real threats and trade-offs
- Excellent written and verbal communication skills
Nice to have:
- CS degree
- CISSP, CISM, or OSCP certification
- Prior DevOps or platform engineering background that transitioned into security
- Experience running third-party security reviews and vendor risk assessments
- Detection engineering at scale (Datadog / SIEM authoring)
