WHAT YOU'LL WORK ONAs the Information Security Engineering Manager, you'll lead the team that owns that mission. This is a player/coach role reporting to the Head of Information Security: you'll manage a team of talented security engineers-setting direction, unblocking their work, and growing their careers-while staying hands-on enough to review a detection, step into an incident, or ship an automation yourself.
Because purchasing a home is often the largest financial transaction of our users' lives, the stakes for getting security right are real. Our Information Security team doesn't rely on assumptions-we identify where they've been made, assess the risk, and communicate it clearly to the business. We define what "normal" looks like across our products, customers, employees, and assets, and we own the detection and response when something deviates from that baseline.
Your mandate is to scale the team's impact faster than its headcount. That means making automation and AI-assisted workflows the default across detection, triage, investigation, and response-so every engineer covers more surface area with higher signal-while preserving the pragmatic, business-first judgment that protects the company without standing in the way of its growth.
Security at Qualia isn't siloed-it touches every team and every product. You'll be as comfortable digging into an alert with an engineer as you are briefing an executive on risk, and you'll represent the team to engineering leaders, auditors, and customers alike. A growth mindset isn't optional here; as the threats we face become more numerous and sophisticated, so must we.
RESPONSIBILITIES- Lead and grow the Information Security team-coaching security engineers, setting goals and priorities, and owning delivery against the security roadmap
- Own detection and response end-to-end: define what "normal" looks like across our products, customers, employees, and assets; build and tune detection logic; and drive down the time it takes to spot and stop what deviates from that baseline
- Serve as incident commander for security incidents-coordinating investigation and containment across teams, communicating clearly under pressure, and running post-incident reviews that feed back into detections and hardening
- Own the escalation path for customer-reported security concerns-including suspected fraud and account compromise-triaging issues, communicating clearly with affected parties, and driving them to resolution
- Scale the team through automation and AI: build AI-assisted triage, investigation, and response workflows that let the team handle growing volume and complexity without growing linearly
- Strengthen Qualia's cloud and corporate security posture-reviewing configurations, monitoring for drift, and raising the bar across identity, endpoints, and SaaS
- Partner across Application Security, IT, Engineering, Legal, and Compliance to embed security into how Qualia builds products and adopts new technology-including AI
- Support Qualia's compliance programs (e.g., SOC 2, ISO 27001) as a pragmatic control owner-strong evidence and clean audits, without letting checkbox thinking crowd out real risk reduction
- Hire and mentor: recruit strong security engineers and build a team culture where people are pushed and supported in equal measure
YOUR BACKGROUND THAT LIKELY MAKES YOU A MATCH- 5+ years of professional information security experience, with both a strong defensive foundation and familiarity with offensive techniques, and 2+ years managing or formally leading a security engineering or security operations team
- Hands-on depth across security operations: detection engineering, SIEM and log monitoring platforms, and incident response, plus at least one adjacent domain (cloud security, identity and access management, or vulnerability management)
- The ability to write code-and a track record of shipping automation that changed how a team worked, ideally including meaningful use of LLMs or agents in a security workflow
- A practical, risk-based approach to security: you care whether the risk actually went down, and you'd rather find a safe path to "yes" than reflexively say "no"
- Strong written communication: you can write the runbook, the post-mortem, the customer-facing incident summary, and the executive briefing-each pitched to its audience
- Experience navigating the security implications of emerging technologies-including AI and large language models-as the company evaluates and adopts new tools
- Familiarity with identity and access management concepts (e.g., SSO, MFA, role-based access controls) and core IT domains, including endpoint management, networking, and cloud infrastructure
- Bachelor's degree in a relevant field, or equivalent practical experience
- Nice to have
- Experience owning security controls in audited environments (e.g., SOC 2, ISO 27001, or GLBA-regulated businesses)
- Information security certifications (e.g., CISSP, GIAC, or similar)
- Offensive security experience (penetration testing, red teaming), or familiarity with the evolving landscape of AI-enabled offense and defense
- Experience in fintech, real estate technology, or another regulated, high-liability domain
While this role is based in Austin, Texas, we're open to exploring remote possibilities for qualified candidates. We have other physical office locations in San Francisco, California, and Concord, New Hampshire.
