Remote-first (India)
Adalat AI builds software and AI for courts and justice systems. Our products help people work with proceedings, documents, and legal information. Protecting the confidentiality and integrity of that information, while keeping essential courtroom workflows available, is central to how we build.
Role Overview
We are looking for a hands-on Head of Security to build and lead our security function, combining technical depth with ownership of security across our products, internal systems, and everyday work.
You will set priorities, work directly on difficult technical problems, and build the people, processes, and tools needed to make security part of how the company operates. You should be comfortable reviewing an application's authorization design, examining a cloud identity boundary, and leading an incident, as well as setting a roadmap and developing a team.
You will work closely with the CTO, engineering and ML leads, deployment teams, and colleagues responsible for IT, People, legal, and operations. We need someone who can explain what matters most, make practical trade-offs, and carry improvements through to verified results.
Key Responsibilities
Set the security direction. Build and maintain a practical security roadmap based on our systems, data, deployment environments, and most consequential risks. Make priorities, ownership, progress, and unresolved risks clear to leadership.
Secure our products and AI workflows. Lead threat modeling and security design reviews across applications, APIs, and AI-enabled features. Strengthen authorization, data boundaries, and protections around model inputs, outputs, and access to tools or data. Help engineers catch problems during design and development.
Strengthen cloud and data security. Set and validate controls for cloud identities, Kubernetes, storage, secrets, encryption and key management, CI/CD, and developer and research access. Work with engineering and deployment teams to protect information throughout its lifecycle, including retention and deletion.
Own internal IT security. Establish an inventory and security baseline for employee devices and business applications. Drive endpoint protection, device management, encryption, patching, secure configuration, and recovery. Strengthen identity and access management through SSO, MFA, least privilege, access reviews, and timely access changes when people join, change roles, or leave. Review SaaS tools, integrations, and employee tooling, including AI tools, and work with the relevant owners to implement and verify controls.
Set practical employee security standards. Define clear expectations for employees and contractors covering acceptable use, approved tools, credentials, device use, remote work, and data classification, handling, sharing, retention, and disposal. Work with People and operations to make the standards understandable and part of onboarding and everyday workflows. Establish a documented exception process with a named approver, risk owner, expiry, and follow-up.
Build a strong security culture. Make it easy to ask questions and report mistakes or suspicious activity early, without blame. Develop role-based onboarding and regular training, practical exercises, and security champions where useful. Work with leaders to model good practices and make their teams' responsibilities clear. Measure adoption and outcomes, including control coverage, reporting readiness, and closure of exercise findings, and improve the program based on what people actually do.
Make vulnerability management effective. Own the path from discovery and intake through prioritization, remediation, and retesting. Coordinate independent security testing where it adds value, and help engineering teams fix underlying causes as well as individual findings.
Build detection and incident response. Establish useful monitoring, clear escalation paths, and response playbooks across products, infrastructure, and internal systems. Lead security investigations and coordinate containment, recovery, and follow-through. Work with the team to define sustainable incident coverage and test our readiness.
Build security capability. Develop the team and specialist support needed as the organization grows. Coach colleagues and use automation to make good practices repeatable. Recommend the staffing, tools, and budget needed to deliver the roadmap.
Support trustworthy assurance. Maintain evidence that controls work and help answer security questions from customers and partners. Work with legal and operations on privacy, contractual obligations, and agreed audit or certification readiness. Keep external commitments grounded in what we can demonstrate.
Qualifications
10+ Years experience building or materially improving a security program, with examples of risks you reduced and changes that held up in production.
Strong hands-on depth in application and cloud security. You can read code, assess architecture, investigate a finding, and work with engineers on a fix.
Practical experience securing employee devices, identities, SaaS applications, and the employee access lifecycle. You can turn policy into controls that work for a growing organization.
Sound judgment about authorization, trust boundaries, cryptography, secrets, and data access. You know when to investigate further and when a simpler control is sufficient.
Experience leading incident response and translating what happened into durable technical and operational improvements.
Evidence that you can lead people and cross-functional work, through hiring, coaching, building a team, or getting sustained security improvements adopted across the company.
Experience making employee security standards and training useful in practice, with evidence of adoption and improved behavior.
Clear communication with technical and nontechnical colleagues. You can explain risk, uncertainty, and trade-offs without losing the detail needed to make a decision.
Useful additional experience
Security for AI inference, model integrations, data pipelines, or self-hosted deployments.
Work with government, public-interest, or other environments where sensitive information and availability matter.
Implementing controls and gathering evidence for SOC 2 or ISO 27001.
Familiarity with Azure, GCP, Kubernetes, or production systems written in Go, TypeScript, or Python.
What You Will Achieve in a Year
A shared view of our main security risks and an agreed roadmap with clear owners, with the highest-priority improvements being delivered and verified.
A baseline view of employee devices, business applications, and access, with priority gaps being closed and a workable process for joining, role changes, and offboarding.
Clear employee security standards, an exception process, role-based onboarding and training, and a reporting route that people know how to use.
A workable product review and remediation process, an exercised incident response plan, and evidence that lessons from training and exercises are being acted on.
A concrete plan for growing security capability, with leadership able to see control coverage, adoption, and important remaining risks.
Why this role
You will help shape how security is built into software used in justice systems and into the company behind it. The role combines direct technical work with the opportunity to build a security function, working closely with the people designing, shipping, deploying, and supporting the products.
We keep our process straightforward and transparent. Here's what to expect:
R1 — Founder Chat (30 minutes)
An introduction to Adalat AI — our mission, the problem we're solving, and an initial conversation around role fit.
R2 — Technical Round (60 minutes)
A take-home assignment and a discussion about it.
R3 — Background Deep-Dive (60 minutes)
A focused discussion on your background — the problems you've worked on, what you've built, and how your experience connects to what we're doing at Adalat AI.
R4 — Offer
If it's a great match on both sides, we'll move forward with an offer.
Benefits and Perks
WFH with flexible work hours.
Unlimited PTO.
Autonomy and ownership.
Learning & development resources — including certifications relevant to this role.
Smart, humble, and friendly peers.
Maternity and paternity leaves.
Contacts within the Harvard / MIT / Oxford ecosystem.