Build and lead Suno’s Corporate Security program as the domain expert for securing Suno’s Corporate IT environment. In this onsite role in New York, you will set standards and a roadmap across identity, endpoint security, detection and response, third-party risk, vendor assessment, and SaaS posture. You will also establish the access model, drive lifecycle automation, and turn recurring security decisions into tooling and policy that scale.
Why this role
- Own the security domain end to end, from access governance and endpoint posture to SaaS configuration and third-party review.
- Set direction with leadership alignment by defining what to secure, in what order, and to what bar.
- Build standards that others can apply through written policy, defaults, and enforcement in tooling.
Responsibilities
- Lead the corporate security domain end to end: identity and access governance, endpoint and vulnerability management, detection and response, third-party integration risk, vendor assessment, and SaaS posture.
- Build your team, enable others, and do hands-on work to mature systems, processes, and behaviors.
- Set the corporate security roadmap with leadership and XFN stakeholders, making sequencing and tradeoffs explicit.
- Own Suno’s access model, including RBAC and entitlement design, least-privilege defaults, and governance enforced in Lumos.
- Define what access review, certification, and approval should look like, and build toward the standard rather than adopting an external framework.
- Drive access lifecycle automation so joiner/mover/leaver is correct by default and exceptions are visible, with a model for non-human identity such as service accounts, agents, and automations.
- Own the security standard for the fleet, including hardening baseline, compliance signals, device trust, and how endpoint posture informs access decisions.
- Own third-party vulnerability management as a program, covering coverage, risk-based remediation SLAs, reporting, and collaboration with teams whose tools create risk.
- Partner with the IT engineer who owns Kandji to deploy security standards as practical policy.
- Own EDR deployment and maintenance, and collaborate with Detection and Response to drive corporate security incidents to closure.
- Own third-party access evaluation, including integration and OAuth review for tools such as Slack and Google Workspace, plus vendor security assessment at purchase and renewal.
- Define risk appetite in practice so others can apply it consistently.
- Turn recurring decisions into policy, scope guidance, and tooling to reduce review queue load as the company grows.
- Own the SaaS application program, including application bar, assessment cadence, and remediation follow-through.
- Improve tenant-level configuration across the portfolio, covering SSO and SCIM coverage, MFA and session policy, admin role hygiene, OAuth grant and token management, and data sharing defaults.
- Collaborate with IT, Security, Engineering, AI Enablement, and Legal on how Suno builds and buys.
- Influence the scope of what comes next, including how GRC plugs in, what to automate versus staff, and where the next investment goes.
- Mentor and raise the technical bar across your team and partner ecosystem, including those outside security.
Requirements
- ~8+ years in corporate/enterprise security or security engineering, including domain ownership of identity, endpoint, or SaaS security rather than ticket-based work.
- Deep hands-on expertise with a modern IdP and IGA/access-governance tooling such as Lumos, Veza, ConductorOne, Opal, or similar.
- Designed and operated an entitlement or RBAC model across a large SaaS portfolio with enough scope to understand what breaks and why.
- Endpoint security depth for a macOS-primary fleet, including MDM-delivered hardening, compliance, device trust, and patch/vulnerability management at scale.
- Strong command of OAuth, SAML, OIDC, and SCIM, plus the ability to model risk behind third-party integrations.
- Experience establishing standards that others apply without constant direct enforcement, through policy, tooling, defaults, or all three.
- Ability to influence engineering and business teams outside direct reporting lines early enough to change outcomes.
- Automation fluency with Python or TypeScript, REST APIs, and a normal habit of building integrations and internal tooling.
- Excellent writing and judgment under ambiguity, including the ability to align with executives and update direction when evidence changes.
- Calibrated approach to risk, including communicating likelihood, impact, and tradeoffs.
Technologies
Lumos, Veza, ConductorOne, Opal, Kandji, EDR, OAuth, SAML, OIDC, SCIM, RBAC, MFA
Benefits
- Company Equity Package
- 401(k) with 3% Employer Match & Roth 401(k)
- Medical, Dental, & Vision Insurance (PPO w/ HSA & FSA options)
- 11 Paid Holidays + Unlimited PTO & Sick Time
- 16 Weeks of Paid Parental Leave
- Creative Education Stipend
- Generous Commuter Allowance
- In-Office Lunch (5 days per week)
Onboarding outcomes
- First 90 days: form a view of security posture, build working relationships across IT and the broader Security team, and identify three areas that are off-target.
- First 6 months: deliver a corporate security roadmap aligned with IT and the CISO, with explicit sequencing and tradeoffs; highest-risk work is already in motion.
- First year: reduce entitlement sprawl and vulnerability backlog, align detection with real risks, keep third-party review efficient enough that teams do not bypass it, and sustain the standard through tooling and shared judgment.
Location, schedule, and compensation
- Location: New York, NY (onsite)
- Work location policy: expected to work from Suno’s NYC or Cambridge, MA office 5 days per week per company policy.
- Travel: willingness to travel up to 25% to lead team members and support offices, with a deliberate cadence in Cambridge and NYC during the first six months.
- Compensation range: $165K - $220K (base salary may vary based on location, skills, qualifications, and experience).
- Eligibility: applicants must be eligible to work in the US.
Helpful, not required: insider risk or DLP programs; zero-trust network access; SOC 2 or ISO program ownership; just-in-time access patterns or identity-as-code; securing AI agent and non-human identity access; prior experience as the first or second security hire at a fast-growing company.
