> Markdown version of [/jobs/ext/2704826-director-it-security](https://www.wearedevelopers.com/jobs/ext/2704826-director-it-security). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Director, IT & Security - **Company:** TONAL - **Location:** Austin, TX, United States (Remote available) - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** Application Programming Interfaces (APIs), Artificial Intelligence, Software System Penetration Testing, Software as a Service, Identity and Access Management, Information Technology Operations, Microsoft Office, Network Architecture, Role-Based Access Control, Security Information and Event Management, Systems Integration, Wi-Fi Technology, Okta - **Published:** September 4, 2026 - **Apply:** https://startup.jobs/director-it-security-tonal-com-8724122 ## About the Role * 10+ years in IT and security leadership, with full functional ownership and experience across identity and access management, endpoint security, SaaS administration, network infrastructure, and security program management. * Hands-on HIPAA compliance implementation experience, beyond writing policies * Track record of building a security program from the ground up: policy, penetration testing, and real incident response * Broad expertise across identity and access management, endpoint security, SaaS administration, and network infrastructure * Equally comfortable configuring technical systems and presenting security risk to executive leadership * A start-up mindset: thrives in fast-moving, resource-constrained environments without cutting corners on security * Proven ability to prioritize with a lean team and limited budget, with outcomes to show for it. * Experience managing a large SaaS portfolio, including contract renewals, vendor negotiation, and license governance * Strong people leadership skills, setting clear expectations and developing team members * High standards of trust, integrity, and discretion, given access to the company's most sensitive systems Extra Credit * HIPAA compliance roll-out and execution, owning the technical controls end-to-end. * Experience with SOC 2 Type II, NIST CSF, or HITRUST in a hands-on implementation capacity * Background in healthcare technology, digital health, or clinical-grade software environments ## Description We're looking for a Director of IT & Security to own this function end-to-end. This role carries the highest privileges across our most sensitive systems and direct accountability for IT and security outcomes company-wide. You'll report to the VP of Business Technology and work closely with senior leadership. The ideal candidate has a start-up mentality - comfortable moving fast in a lean, resource-constrained environment, while never losing sight of the security and compliance discipline a healthcare-adjacent company requires., * Own end-to-end IT operations, including device lifecycle, onboarding/offboarding, SaaS administration, identity and access management, help desk, and office infrastructure across all locations. * Lead the technical controls side of Tonal's HIPAA compliance program, implementing the safeguards required by the HIPAA Security Rule and HITECH Act - encryption, SIEM, MDM/EDR, and role-based access. * Own and execute Tonal's security program: penetration testing remediation, security policy, tabletop exercises, vendor security reviews, and incident response. * Govern Tonal's AI tool ecosystem, including licensing, spend, API key governance, corporate AI policy, and DLP and prompt injection protections. Drive AI training and best practices across the organization. * Administer Tonal's SaaS portfolio, owning contract renewals, license optimization, and vendor negotiations across critical platforms. * Drive automation and identity governance maturity, including Okta Identity Governance, expanding SCIM-based provisioning, building & enforcing RBAC frameworks, and driving workflow automation and system integration. * Lead and grow the IT & Security team, managing engineers and administrators, overseeing the virtual CISO engagement, owning the budget and aligning org structure to Tonal's needs. * Own IT documentation and process improvement, maintaining runbooks and closing gaps in onboarding, offboarding, and incident response, and driving overall automation. * Manage global physical infrastructure - networking, Wi-Fi, AV, and physical access - across a distributed, multi-office footprint. * Serve as a trusted operator on Tonal's most sensitive matters, from executive access provisioning to security incidents and legal holds. * Report regularly to senior leadership and the C-suite, translating IT & Security roadmap priorities, progress, technical risk and incident management into clear, actionable narratives. ## Related Videos - [Building Security Champions](https://www.wearedevelopers.com/videos/193-building-security-champions) - [Smart, Connected, Unexpected: The Wild Side of IoT and AI](https://www.wearedevelopers.com/videos/1113-smart-connected-unexpected-the-wild-side-of-iot-and-ai) - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Prototyping with Hardware and the Web](https://www.wearedevelopers.com/videos/651-prototyping-with-hardware-and-the-web) - [Unleashing the Power of Developers: Why Cybersecurity is the Missing Piece?!?](https://www.wearedevelopers.com/videos/712-unleashing-the-power-of-developers-why-cybersecurity-is-the-missing-piece) - [Car's are Technology on Wheels - Impact of Software and IT Competence in Automotive](https://www.wearedevelopers.com/videos/780-car-s-are-technology-on-wheels-impact-of-software-and-it-competence-in-automotive) ## Related Articles - [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again) - [Building Security Champions](https://www.wearedevelopers.com/magazine/87-building-security-champions) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Trustworthy AI Starts at Deployment: 5 Checks Before You Ship](https://www.wearedevelopers.com/magazine/753-trustworthy-ai-starts-at-deployment-5-checks-before-you-ship) - [Best US AI Conferences for CTOs in 2026: Build vs. Buy, Vendor Evaluation, and Peer Intelligence](https://www.wearedevelopers.com/magazine/736-best-us-ai-conferences-for-ctos-in-2026-build-vs-buy-vendor-evaluation-and-peer-intelligence) - [The Best X (Twitter) Accounts for Developers](https://www.wearedevelopers.com/magazine/294-the-best-x-twitter-accounts-for-developers)