VP of Security, HubSync

Location: Remote

About HubSync 

HubSync is an AI-native tax workflow platform for the country's largest CPA firms. Firms trust us with their clients' most sensitive financial and tax data, and security is central to how we build and run the product. We're hiring a VP of Security to lead and scale our security program as we grow. 

The Role 

You'll be HubSync's senior security leader, responsible for security across our product, cloud infrastructure, corporate IT and compliance. You'll take over an established program: a dedicated AWS security and network operations partner, a 24/7 security operations center (SOC), regular external penetration testing, continuous AI-driven testing, and company-wide device security and training. You'll own and grow that program, and you'll be the security voice our enterprise customers and board rely on. 

What You'll Do 

• Own HubSync's security strategy, roadmap and budget, and report on risk and progress to the CEO and the board. 

• Lead security across our multi-account AWS environment and our application platform, working with engineering as a partner. 

• Lead application security practice across the development lifecycle, including code analysis, release testing and secure design review. 

• Manage our security partners: AllCloud (AWS security and network operations), Sentry (SOC), LBMC (device security and training), and our external penetration testers. 

• Own detection, monitoring and incident response readiness, including playbooks and tabletop exercises. 

• Run our compliance program (SOC 2 Type II, plus other frameworks as customers require) and lead security reviews, questionnaires and audits with enterprise CPA firm customers. 

• Set security governance for AI features: data handling, model and vendor risk, and customer data boundaries. 

• Lead corporate and physical security for our US and offshore teams, including endpoint protection, identity, access reviews and security awareness. 

• Build and lead a security team over time, and take ownership of the work our vCISO covers today. 

What You Bring 

• 10+ years in security, including 4+ years leading a security program at a B2B SaaS company that handles sensitive financial, tax or regulated data. 

• Deep hands-on AWS security expertise, including WAF, Shield, IAM, GuardDuty, Security Hub and multi-account governance. 

• A strong application security background, including multi-tenant SaaS architecture. 

• Experience securing AI and LLM products, including data handling, prompt-injection defense and AI vendor risk. 

• Experience leading SOC 2 audits and enterprise customer security reviews. 

• A track record of getting results from SOC, managed security and penetration testing partners. 

• Incident response leadership. 

• The ability to explain risk plainly to a board and work as a peer with engineering leaders. 

• Experience supporting distributed teams, including offshore. 

Nice to Have 

• Experience in accounting, tax, fintech or professional services. 

• CISSP, CISM, OSCP or AWS Security Specialty certification. 

• Familiarity with ISO 27001, IRS Publication 4557, the FTC Safeguards Rule or GLBA. 

Year One 

• First 90 days: Take full ownership of the program and partners, and present your roadmap to the CEO and board. 

• By 6 months: Lead customer security reviews end to end and run an incident response tabletop exercise. 
• By 12 months: Complete a SOC 2 Type II cycle and make HubSync's security posture a competitive advantage with enterprise firms. 

HubSync is an equal opportunity employer. All applicants will be considered for employment without attention to race, color, religion, sex, sexual orientation, gender identity, national origin, veteran or disability status.