• Perform weekly code reviews to catch vulnerabilities before they ship • Track, prioritize, and drive remediation of security vulnerabilities across the stack • Coordinate external security audits and penetration tests, and follow through on findings • Maintain and evolve our risk register, mapping all company services and prioritizing what's exposed • Support audit follow-up and keep GRC documentation up to date • Communicate new threats to the team, document findings, and broadcast security updates company-wide • Run phishing simulations and security training (via Riot) • Own the monitoring of security channels and alerts, including weekend coverage, so nothing goes unanswered • Set up and secure new employee devices (MDM), manage access provisioning/deprovisioning • Keep an eye on emerging attack techniques targeting generative AI (prompt injection, jailbreaks, content filter bypass) • Track security incidents and vulnerabilities disclosed by the third-party AI providers we rely on

• Take ownership of protecting our product, users, and collaborators • Perform weekly code reviews to catch vulnerabilities before they ship • Track, prioritize, and drive remediation of security vulnerabilities • Coordinate external security audits and penetration tests • Maintain and evolve our risk register, mapping all services • Support audit follow-up and keep documentation up to date • Communicate new threats to the team and broadcast security updates • Run phishing simulations and security training • Monitor security channels and alerts with weekend coverage • Set up and secure new employee devices (MDM) • Track security incidents and vulnerabilities disclosed by AI providers

• Perform weekly code reviews to catch vulnerabilities before they ship • Track, prioritize, and drive remediation of security vulnerabilities across the stack • Coordinate external security audits and penetration tests, and follow through on findings • Maintain and evolve our risk register, mapping all company services and prioritizing what's exposed • Support audit follow-up and keep GRC documentation up to date • Communicate new threats to the team, document findings, and broadcast security updates company-wide • Run phishing simulations and security training (via Riot) • Own the monitoring of security channels and alerts, including weekend coverage, so nothing goes unanswered • Set up and secure new employee devices (MDM), manage access provisioning/deprovisioning • Keep an eye on emerging attack techniques targeting generative AI (prompt injection, jailbreaks, content filter bypass) • Track security incidents and vulnerabilities disclosed by the third-party AI providers we rely on

• Take ownership of protecting our product, users, and collaborators • Perform weekly code reviews to catch vulnerabilities before they ship • Track, prioritize, and drive remediation of security vulnerabilities across the stack • Coordinate external security audits and penetration tests, and follow through on findings • Maintain and evolve our risk register, mapping all company services and prioritizing what's exposed • Support audit follow-up and keep GRC documentation up to date • Communicate new threats to the team, document findings, and broadcast security updates company-wide • Run phishing simulations and security training (via Riot) • Own the monitoring of security channels and alerts, including weekend coverage, so nothing goes unanswered • Set up and secure new employee devices (MDM), manage access provisioning/deprovisioning • Keep an eye on emerging attack techniques targeting generative AI (prompt injection, jailbreaks, content filter bypass) • Track security incidents and vulnerabilities disclosed by the third-party AI providers we rely on