Head of Information Security & IT
$225k - $270k+ Equity participation
Senior, Expert
Brooklyn, NY, USA
HybridAll employees attend team week events at the Brooklyn headquarters three times annually.
Cybersecurity
About the job
Requirements
- At least 7 years of information security experience, including meaningful hands-on technical experience and increasing ownership of security programs.
- Strong technical judgment and the ability to investigate problems, develop solutions, build proofs of concept, and implement controls when appropriate.
- Broad experience across cloud and application security, identity, vulnerability management, and detection and response.
- Experience owning or materially leading an information security program, including risk management, policies, controls, and security roadmap, leveraging frameworks such as NIST, CIS, or GDPR.
- Experience leading SOC 1, SOC 2, ISO 27001, or comparable security assurance and certification programs.
- Experience representing an organization's security controls, certifications, and risk posture with enterprise customers and auditors.
- Strong security instincts and curiosity about emerging threats, including the implications of AI.
- Strong executive communication skills and the ability to translate technical controls, risks, and security strategy into clear business language.
Responsibilities
- Own Chronograph's information security program, strategy, architecture, and roadmap.
- Serve as Chronograph's senior security leader in strategic client, partner, and external engagements.
- Lead and mentor a small team of senior security, compliance, and IT practitioners.
- Continuously assess the security posture and prioritize pragmatic, high-impact improvements.
- Communicate material security risks, priorities, and tradeoffs clearly to executive leadership.
- Develop a deep understanding of the business, product, and infrastructure to make sound security decisions.
- Develop technical approaches for security initiatives, validate assumptions, and build proofs of concept where useful.
- Implement security controls directly where appropriate, while partnering with engineering and infrastructure teams on more complex efforts.
- Maintain sufficient technical depth across cloud, application architecture, identity, logging, and security tooling to investigate issues and guide implementation.
- Evaluate and configure security tooling and automation.
- Own the security posture and requirements for cloud and application environments, partnering with infrastructure and engineering teams on implementation.
- Lead vulnerability management and threat modeling programs, hands-on where needed.
- Partner with engineering on secure development practices and application security architecture.
- Own and improve application security tooling, including SAST, SCA, DAST, SOAR, secrets detection, and infrastructure-as-code scanning.
- Prioritize vulnerabilities based on exploitability and business risk.
- Own security strategy for Chronograph's use of AI internally and within its products.
- Secure employee use of AI tools, agents, models, and integrations, including controls around sensitive data, third-party services, and agent permissions.
- Threat-model AI-enabled functionality, including prompt injection, data exfiltration, insecure tool use, excessive agency, and supply-chain risks.
- Track developments in offensive and defensive AI security and assess their relevance to Chronograph.
- Evaluate AI-enabled security tooling and automation where it can improve defensive capabilities.
- Own the detection and response stack, including SIEM, EDR, WAF, and DLP, as well as the automation routing alerts between them.
- Lead threat detection and incident response strategy, including security partner relationships.
- Set direction for corporate IT, identity, endpoint management, and employee technology, with the IT team owning day-to-day operations.
- Own the SOC 1, SOC 2, ISO 27001, and broader security assurance strategy, with the GRC team managing day-to-day audit and evidence processes.
- Ensure certifications, policies, risk management processes, and technical controls operate as a coherent information security program.
- Set direction for the annual risk assessment, risk register, policy lifecycle, and third-party risk program.
- Partner closely with compliance, sales, and customer teams on security due diligence, customer requirements, and strategic client engagements.
- Represent Chronograph's controls, certifications, and approach to risk to customers, prospects, and auditors.
About the company
Chronograph provides subscription software for private equity portfolio monitoring. It runs in the cloud to automate data collection, warehousing, analytics, valuation, and reporting, giving transparency across portfolio companies, assets, funds, and commitments. It differentiates itself by focusing on the private capital ecosystem with an integrated platform that combines traditional analytics with generative AI to speed up decision-making. Its goal is to help institutional investors and private equity teams maximize the value of their data and achieve better relative performance through clear, timely insights and reporting.
Company Size
51-200
Company Stage
Growth Equity (Venture Capital)
Total Funding
$163M
Headquarters
New York City, New York
Founded
2016
Get referred to Chronograph
See people who can refer or advise you
Simplify's Take
What believers are saying
- June 2026 Sixth Street Growth invested over $140 million, funding AI and private credit.
- April 2026 UAE hire expands Middle East and Asia sales into sovereign funds.
- Semantic Search and the 2026 private-credit platform widen product breadth.
What critics are saying
- 2026 buyers compare Chronograph against Allvue, iLEVEL, FactSet Cobalt, and Standard Metrics.
- Lumonic and Reuben sell AI-native workflows, shrinking Chronograph into a reporting module.
- If clients rely on warehouse connectors, OpenAI and Perplexity commoditize Chronograph's interface.
What makes Chronograph unique
- Chronograph serves 8 of the top 10 GPs and 5 of the top 10 LPs globally.
- Its deterministic, point-in-time data model survives audit and committee scrutiny.
- June 2026 OpenAI, Anthropic, and Perplexity connectors embed validated private-capital data.
Help us improve and share your feedback! Did you find this helpful?
Benefits
- Flexible Work Hours
- Unlimited Paid Time Off
- Company Equity
- Health Insurance