Chief Information Security Officer (CISO) Remote (anywhere in United States)

As Coder's CISO, you will define and execute our security vision, strategy, and risk management framework across our product, cloud infrastructure, and enterprise operations. You will report directly to the CFO, lead both our Security and IT organizations, and serve as the primary public voice of security for our customers, partners, and the broader open source community.

To be clear about who we're looking for: the right person for this role is a leader who stays close to the technical work as the company grows. We want an engineer at heart. Someone who genuinely loves building, can go deep on architecture with our engineers, and earns trust through technical credibility as much as through leadership. You'll set strategy for the whole company, but you'll also enjoy reading a design doc, poking at a threat model, or digging into how an AI agent should be sandboxed.

You’ll inherit two capable teams: a 4-person Security team led by our Lead Security Engineer, and an 8-person IT team (including a dedicated security engineer) led by our Director of IT. From there, you'll grow specialized functions across GRC, Detection and Response, and Application Security as Coder scales.

What You'll Do:

Be the Public Face of Security

Lead through incidents: Serve as incident commander during critical security events and own crisis communications, coordinating customer advisories, status page updates, blog posts, and executive briefings alongside Legal, Support, and Marketing.

Represent Coder to customers: Act as our executive security advocate with enterprise and federal prospects, customers, and partners during security reviews, high-stakes briefings, and sales conversations.

Run responsible disclosure: Oversee vulnerability management and disclosure for our open source codebase and enterprise customers, including researcher reports, CVEs, and security advisories.

Stay Hands-On with Engineering and AI Security

Bring real technical depth: Lead architecture reviews and secure design guidance for our Go and TypeScript codebases, staying close enough to the work to be credible without reviewing every pull request.

Build secure paths for engineers: Give engineering secure-by-default tooling, automated CI/CD guardrails, artifact signing, SBOMs, dependency scanning, and strong cloud security across AWS, GCP, and Kubernetes.

Set the bar for AI security: Define how Coder secures AI agents, including prompt injection defenses, tool use permissions, and the safe use of both open-weight and SaaS models.

Lead and Grow the Security and IT Organizations

Lead and scale the team: Mentor our existing Security and IT leaders and team members, define clear career paths, and hire strong talent for new functions such as GRC and Detection and Response.

Own security and IT strategy alignment: Work hand in hand with our Security leader and Director of IT to set company-wide identity, device, and access strategy (Okta, Google Workspace, MDM, EDR) that balances strong controls with a great employee experience.

Advise the board and executives: Regularly present our risk posture, security roadmap, and compliance progress to the CEO, executive team, and Board of Directors.

Build a GRC Program That Opens Doors

Mature our compliance program: Maintain SOC 2 while leading Coder toward ISO 27001, ISO/IEC 42001 (AI Management Systems), AIUC-1 (AI agent security), and CMMC to unlock new government and enterprise markets.

Manage vendor and legal risk: Partner with Legal on privacy, customer security commitments, third-party vendor risk, and regulatory compliance.

What Success Looks Like in Your First Year

First 90 days: You know the people, the product, and our risk landscape. You've met key customers, assessed the Security and IT teams, and shared a prioritized security roadmap with the CEO.

By 6 months: Your org structure and hiring plan are in motion, incident response is battle-tested, and engineering sees Security as a partner that helps them ship faster and safer.

By 12 months: SOC 2 remains clean, ISO 27001, ISO/IEC 42001, AIUC-1, and CMMC is underway, and Coder is recognized by customers as a leader in securing AI agents and developer environments.

What We're Looking For

10+ years of security experience, with 5+ years leading security organizations as a Head of Security, VP, or CISO at a fast-growing enterprise software company.

A builder's mindset and a genuine love of engineering. You came up through software engineering, AppSec, or security engineering, and you still enjoy going deep on technical problems.

A proven record of hiring, delegating, managing existing team leaders, and scaling functional teams across AppSec, GRC, SecOps, and IT.

Hands-on experience leading executive response and crisis communications for critical security incidents across an enterprise customer base.

Experience supporting enterprise sales, handling customer security reviews, and building compliance programs such as SOC 2, ISO 27001, and FedRAMP.

Strong experience managing corporate IT and identity strategy in a remote or distributed company.

Nice to Have

US citizenship and the ability to obtain a US security clearance.

Direct experience taking a company through FedRAMP authorization (ideally the FedRAMP 20x pathway) or CMMC certification.

Experience with ISO/IEC 42001, AIUC-1, or other AI governance and AI agent security frameworks.

Security leadership experience at a developer platform, DevOps, or open source company selling to security-conscious enterprises.

Contributions to standards bodies or industry frameworks, such as NIST or the NCCoE.

A public presence in the security community, such as talks, research, or published writing.

About Coder

Coder is the leading platform for AI development Infrastructure, enabling enterprises to securely run human and AI-driven development workflows in consistent, governed environments. Coder provides self-hosted, agent-ready workspaces that unify developer productivity and platform governance. With Coder, enterprises can confidently evolve from human-only development to AI-assisted and autonomous workflows, without sacrificing security, compliance, or performance. Learn more at coder.com.

Interview process

We believe that the interview process should be transparent, consistent, and enjoyable. We value your time and hope to complete the interview process in two to four weeks, if schedules allow. Through your interviews, you will meet a mix of individual contributors, managers, and senior leaders.

AI use during the interview process

As an AI company, Coder embraces the use of AI tools, and we want to be transparent about our expectations as you navigate our interview process.

Not permitted: Using AI assistance during conversational interviews.

Permitted: Using AI tooling for take-home assessments. Please flag where and to what extent it was used in your take-home. Your submission will not be penalized for using AI as long as it is done honestly.

Our use of AI in hiring

We use AI tools to help manage our recruitment process efficiently and fairly. Specifically:

Ashby and Brainerr help us review inbound applications by surfacing candidates who best match the role requirements we've defined. This tool does not make hiring decisions; it helps our team prioritize which applications to review first.

Granola takes notes during our interview calls so our team can focus on the conversation with you.

All hiring decisions are made by humans. Our team reviews applications, conducts interviews, and makes final selections. AI tools assist us but never replace human judgment, and these practices are conducted in compliance with applicable data protection, AI governance, and labor laws. Your data is not used to train AI models.

In accordance with New York City Local Law 144, an independent bias audit has been conducted on "Automated Employment Decision Tools"; results are available for Ashby.

If you're applying for a role at Coder and have questions about how we use AI in our process, or if you'd like to request information about the data we collect, please contact careers@coder.com.

Coder is a proud Equal Opportunity Employer

We are committed to providing equal employment opportunities to qualified applicants and do not discriminate on the basis of race, color, ancestry, religion, sex, pregnancy, gender, gender identity, gender expression, sexual orientation, national origin, age, marital status, genetic information, disability, protected veteran status or any other characteristic protected by federal, state, or local laws.