About Sequencing
Sequencing is the world’s largest direct-to-consumer whole genome sequencing platform, helping define the future of AI-powered personalized health.
We’re a Series A venture-backed, fully remote company turning clinical-grade whole genome sequencing into meaningful, personalized insights. Through AI and a growing ecosystem of genomic applications, we’re building the trusted home for every genome.
In 2026, GenomeWeb named Sequencing a Best Places to Work winner, highlighting our fully remote culture of autonomy, transparency, and growth. As our COO, Shara Birn, put it: “We hire talented people, give them meaningful responsibility, and trust them to make decisions.”
The Opportunity
Sequencing is hiring its first dedicated security leader. Security today is owned across Engineering and Platform, backed by external penetration testing partners and an active HIPAA program. This role brings it under one owner and builds the function from the ground up.
This is a hands-on role. You will execute the majority of the work yourself for the first year, from writing policy to triaging pentest findings to configuring controls, and hire and coach a small team as the program matures. If you are looking to direct work rather than do it, this is not the right role.
We are an AI-first company and expect the same of our security leader. You will use AI daily in your own work, from drafting policy to triaging findings to building detections, and you will set the company's posture on AI as adopt and govern, not restrict. Security here exists to make fast AI adoption safe, not to slow it down.
You report to the Head of Engineering and work alongside Platform Engineering, which owns infrastructure security implementation, and the Bioinformatics and AI functions. The data you protect is whole genome sequences and health data for consumers, which makes this one of the more consequential first-security-hire roles available.
First Six Months
Create the security ownership map with Platform Engineering: they implement infrastructure controls, you set policy, run assurance, and own AppSec, offensive security, and incident response leadership.
Complete a HIPAA and HITECH review and deliver a prioritized remediation roadmap by day 45.
Reach SOC 2 readiness within six months, aligned with the infrastructure roadmap.
Formalize incident response: severity model, escalation paths, communications, executive coordination, and post-incident review.
Extend security policy to AI tooling and model providers, including data classification, acceptable use, and data-handling standards.
Ongoing
Run the security program: policy, risk register, security awareness and training, and the GRC tooling that keeps evidence current.
Run offensive security yourself: scope and manage external pentest firms, triage findings, and drive remediation with the owning teams.
Own security review of third-party data flows: partner and marketplace apps, provider data sharing, marketing and analytics integrations, and AI model providers, including data-processing terms.
Own security standards for contractors, agencies, and third-party development partners across a distributed workforce, including IP protection, device management, and access lifecycle.
Own SaaS governance, shadow IT visibility, and identity lifecycle policy.
Apply AI to the security program itself: AI-assisted detection and log triage, automated evidence collection, policy and control drafting, and code and infrastructure review. Measure and report where it moves the needle.
Serve as the escalation point for security incidents, including after hours when needed.
Report security posture, risk, and roadmap to the founder and leadership team in plain, business-oriented language.
Translate security findings into practical actions engineering teams can implement without slowing product velocity.
Who You Are
8+ years in security, including at least one stretch as the first or only security leader at a company under a few hundred people. Building from zero matters more here than years or title.
Have taken a company through SOC 2 or built a HIPAA program from scratch. ISO 27001 is a plus.
Hands-on in AWS and web application security. You can read a Terraform PR, triage a pentest finding, and tune a WAF rule yourself.
Still hands-on and want to stay that way. You have run pentests through vendors, triaged the findings yourself, and closed them with engineers.
Have secured a consumer-facing product at scale, including identity and account security, MFA, credential stuffing defense, session and account recovery abuse.
Understand privacy and breach obligations beyond HIPAA
Already work AI-first. You use coding assistants and LLMs daily and can show us how they changed your security workflow. You believe the answer to "should we block this AI tool" is almost always "no, here is how we govern it."
Exceptional communicator under pressure. You have briefed a board, founder, or executive team during a live incident, and you can explain risk and tradeoffs to non-technical leaders in plain language, in writing and in the room.
Nice to have: healthcare or genomics experience; familiarity with state genetic privacy laws, the FTC Health Breach Notification Rule, and state breach notification requirements; ecommerce or payment-processing security; ISO 27001; PCI DSS; Drupal security; GDPR and international data transfers; mobile application security; Vanta or Drata; SIEM; Cloudflare Enterprise; and Zero Trust.
Why Sequencing?
For decades, the human genome has been one of the richest health information in the world, but most people have never been able to truly understand or use it. We’re changing that.
We're transforming billions of genetic variants and decades of scientific research into technology people can interact with naturally and trust. This isn't another health app. It's a new category that brings together bioinformatics, genetics, and consumer health.
Your work won’t just help build Sequencing. It will help redefine how people understand themselves through their DNA for decades to come.
Our values spell out the four DNA bases: Advocate, Commit, Guide, Trust.
Benefits
Comprehensive medical, dental, and vision insurance coverage
401(k) with company match
Paid time off
Paid volunteer time off annual, during normal business hours
Fully remote work, with equipment provided and internet and cell reimbursements
Parental bonding leave
Private, confidential clinical-grade whole genome sequencing for you and your immediate family
Join us in helping build the interface between humanity and its DNA!