Director of Security & Compliance

About the job About Us In 2020, a group of senior technology and product experts from Google and Verily China decided to delve into the intelligent digitalization of life science clinical research. Their findings resulted in AlphaLife Sciences, a pioneer in the fusion of life sciences and AI computer science as an AI-enabled integrated clinical research platform. Our flagship product, AuroraPrime, integrates Generative AI and Large Language Models (LLMs) into a powerful AI-driven SaaS platform. Trusted by global top MNCs, our innovations accelerate drug development and market entry. We are committed to globalizing AuroraPrime to enhance clinical trials and real-world research by leveraging cutting-edge AI, cloud computing, and big data. We help our clients achieve clinical operational efficiency, automate processes, and make smarter decisions to get their products to market faster. We are proud partners with Microsoft's Pegasus Program, Google for Startups, and Johnson & Johnson Innovation JLABS, delivering cutting-edge solutions like Generative AI-Copiloted Medical Writing, Intelligent EDC and Data Management, and Agile Trial Management. AlphaLife Sciences is seeking a senior security and compliance leader to build and own our security program from the ground up. You will protect the company, our clients, and our intellectual property from internal and external threats, formalize our security policies alongside our legal partners, and serve as AlphaLife's external voice on security and data protection with pharmaceutical clients, law firms, and the broader industry. We're looking for a sharp-judgment security leader who pairs a strong technical foundation with an even deeper command of compliance policy. The right candidate knows the life science industry's data protection and regulatory compliance frameworks (ISO 27001, SOC 2, GxP, HIPAA) inside and out, understands the value of scientific and commercial data in life sciences, can navigate international regulations and cross-border data risk, and brings the executive presence to serve as AlphaLife's spokesperson on security policy and legal matters at conferences and in client conversations. This person may come from an IT and security or data protection leadership role at a big pharma, or from a regulatory policy lead role at a life science SaaS company.

Responsibilities

• Protect the organization from external and internal security threats across our platform, infrastructure, and corporate systems.

• Quickly assess risks and determine what is and isn't a credible threat, then prioritize and lead the response.

• Build and formalize AlphaLife's security policies, standards, and procedures from the ground up.

• Partner with our US and international law firms to draft, implement, and enforce policies that meet legal and regulatory standards.

• Safeguard sensitive scientific, clinical, and commercial data, with a focus on protecting AlphaLife's and our clients' intellectual property.

• Monitor international data and security regulations and advise leadership on cross-border data sharing and geopolitical risk in our key markets.

• Represent AlphaLife at industry conferences and serve as the primary security point of contact for pharmaceutical clients, law firms, and other partners, including security reviews and due diligence.

• Own AlphaLife's compliance certifications and framework alignment, including ISO 27001 and SOC 2, and keep our platform and processes aligned with GxP and HIPAA requirements.

Qualifications

• Bachelor's or Master's degree in Computer Science, Cybersecurity, Information Systems, or a related field.

• 10 years of experience in cybersecurity, information security, or security compliance, including experience building or leading a security program.

• Strong technical foundation in cloud security, application security, and threat detection and response.

• Experience protecting sensitive data in life sciences, pharma, biotech, or another highly regulated industry.

• Deep understanding of intellectual property and its value, with experience safeguarding proprietary scientific or commercial information.

• Working knowledge of international data protection and security regulations (e.g., GDPR, PIPL, US federal and state frameworks) and cross-border data transfer requirements.

• Deep familiarity with the life science industry's data protection and regulatory compliance policy, including HIPAA and GxP, and with frameworks such as ISO 27001 and SOC 2. Compliance policy fluency carries even more weight for this role than pure technical depth.

• Experience working with outside legal counsel to draft and implement policy.

• Excellent communication skills and executive presence, with comfort presenting to senior client stakeholders and conference audiences.

• Comfortable working in a fast-paced startup environment with ambiguity and evolving priorities.

Nice-to-have

• Certifications such as CISSP, CISM, CISA, or CCSP.

• Experience leading SOC 2 or ISO 27001 efforts at a startup or growth-stage company.

• Hands-on experience with 21 CFR Part 11 and computer system validation.

• Experience operating in or alongside the China market.

• IT and security leadership or data protection experience at a big pharma, or regulatory policy leadership at a life science SaaS company.

• Background securing AI/ML or Generative AI platforms.

AlphaLife Sciences is an equal opportunity employer and does not discriminate based on protected veteran status, disability, or other legally protected status. If you require a workplace accommodation or adjustment during the application and hiring process, including support for the interview or onboarding process, please notify our recruiters at any stage of the process.

Please note: Applicants must be authorized to work in the United States without the need for current or future visa sponsorship. At this time, AlphaLife Sciences is unable to sponsor visas for applicants.