Job Description

About the Role

Constellation wants to do bigger things faster: adopt AI ambitiously in our own work, host sensitive research, and help the organizations in our network collaborate more closely than they could alone. As our first CISO / Director of Infosecurity, you’ll make that possible, reporting directly to our CEO.

Your goal is calibrated risk, not zero risk. Understanding what threats matter the most will allow us to say “yes” to more, while safeguarding the trust that researchers and partners have in us. Today that responsibility is shared across several people; you will own it. You will set our security strategy, own our critical digital infrastructure, lead incident response and decide with leadership how much risk we take on in pursuit of our mission. You will also help the researchers and partner organizations we host to reduce their own digital risk.

We are open to considering full time, part time, or contract candidates. Please indicate your preference(s) including onsite (preferred), hybrid or remote when applying.

Why this role is unique:

• Security is what allows our network to do more together. What would make researchers and organizations at Constellation more productive is easy to imagine: a directory that helps people find collaborators, data and tools shared across organizations, AI agents working in our systems. The hard part is consent, access and trust across dozens of organizations. You will work out how to do these things safely, so that we can do them at all.
• Our mission depends on trust. We hold sensitive information about the people and the organizations shaping AI safety. Targeted, hostile activity is a realistic part of our threat model. Few security leaders get to work where the consequences are this concrete.
• Security decisions reach beyond our four walls. Constellation is a hub for researchers and organizations across AI safety. Roughly half your time goes to Constellation itself, ~30% to partner organizations in our network, and ~20% to ecosystem-wide thinking. The processes, policies, and systems you build here can become useful to AI safety as a whole.
• You are our first CISO / Director of Infosecurity. You will write our threat model, decide how much risk we accept, and build the function.

What you’ll do:

• Be accountable for Constellation’s security posture. Set the strategy. Define and document our cybersecurity threat model: which threats we care about most, how much risk we accept and how our stance should change as the world changes quickly.
• Own critical infrastructure. Be the leadership level owner of access control, our communication infrastructure, audit logging, endpoint management and the software and hardware we provide to contractors; along with the digital infrastructure that serves the network, and the new infrastructure we build to support our mission.
• Lead incident response. Build and run our incident response capability, from detection through recovery and communication with affected people and partners.
• Secure how we use AI. Set the security posture for AI agents and AI-enabled workflows across our systems.
• Review vendors and integrations. Assess the security of third-party tools, integrations and vendors before we rely on them, and respond when a vendor or partner has an incident.
• Support the organizations we host. Decide with leadership what digital security support we offer researchers and partner organizations, and deliver it. This could include shared best practices and collective threat modeling.
• Build the function. Shape the team and the contractors around you, filling gaps in areas such as cloud security, penetration testing and blue team work.

Who you are:

We care about what you have done. The experience below is listed with the strongest signals first and is not a checklist, you do not need all of it.

• Securing SaaS platforms, including configuration, access, and integrations.
• Leading real incident response, from detection through recovery, and communication to stakeholders.
• Enabling ambitious AI agent use and AI-enabled workflows.
• Hiring and managing a security team, including contractors.
• Reviewing the security of vendors and third-party integrations.
• Cloud security and identity management, and secure software development
• Data governance

You are also someone who can:

• Explain risk plainly to leaders who are not security experts, and help make decisions about it
• Build something from scratch
• Work with and earn the trust of partner organizations across the AI safety ecosystem
• Care about AI safety and about the trust placed in us by the people we serve

What success looks like in your first 3 months

By the end of month 3, these things are true:

• We have a conscious security strategy. Constellation has a documented threat model that says what we protect, from whom, and how much we should care about each threat vector. It explains how our stance should change as the world changes. Leadership has read and is bought in.
• We have decided how to serve the people we host. Constellation has decided what the digital threat model is for the researchers and organizations we host, how much support we offer them and what form it takes (e.g. MDM-enrollment workshops, shared best practices, or collective threat modeling).
• We have said yes to something we’d previously held back on, like an internal directory or broader agent access.