Founding / Fractional Chief Information Security Officer

Remote | Fractional | Equity-Based Pre-Funding | Intended Transition to a Salaried, Full-Time Role Following Funding Previously applied? We encourage you to reapply. Our architecture and security requirements have evolved. Candidates who previously applied to Accord Intelligence or CypherShield for a CISO or security leadership position are welcome to submit an updated application. About the Opportunity Accord Intelligence is developing AI decision-intelligence infrastructure for high-stakes environments. Our platform, Accord Core, coordinates specialized models, evaluates their conclusions, preserves meaningful disagreement, and supports evidence-backed decisions within defined policy and authorization boundaries. Our product roadmap includes the Accord Aegis anti-phishing engine, wireless and network intelligence through Lamarr, and future private, on-premises, edge, and field-deployed AI systems. We are seeking a Founding / Fractional CISO to build the security function for our company and products. This is a hands-on leadership role—not a policy-only advisory appointment. You must be comfortable designing architecture, implementing controls, reviewing configurations, working directly with engineers, and demonstrating measurable risk reduction. Reporting to the Founder and CEO, you will collaborate with our CTO, Chief AI Officer, engineering, DevOps, and product teams. Your immediate priority will be securing our operating environment and supporting enterprise demonstrations and pilots. Your longer-term mandate will be building the security capabilities required for enterprise and regulated markets. What You Will Own Security leadership and governance Establish our security strategy, prioritized roadmap, risk register, control ownership, policies, and operating cadence. Define security release criteria, exception handling, and accountable risk acceptance. Communicate material risks to leadership and develop future staffing, budget, and specialist-support requirements. GCP, Microsoft 365, and identity security Assess and harden GCP development, staging, and production environments. Implement least privilege, service-account governance, environment separation, network controls, secrets management, encryption, and monitoring. Secure Microsoft 365, Entra ID, Exchange Online, collaboration permissions, application consent, endpoints, and remote access. Establish MFA/SSO, privileged-access controls, break-glass procedures, access reviews, onboarding/offboarding, and domain/email authentication governance. AI security and independent assurance Secure multi-model orchestration, agent communication, CAM/SLM interactions, Agora exchanges, MCP integrations, retrieval, model-serving infrastructure, and tool use. Address prompt injection, data and memory poisoning, sensitive-information exposure, agent impersonation, excessive permissions, and unauthorized actions. Preserve a fundamental boundary: model confidence or agreement must never override policy, required approvals, or execution permissions. Partner with AI leadership on adversarial testing, evaluation integrity, controlled model updates, and separation between research, deployment approval, and runtime authorization. Product security and DevSecOps Embed security into APIs, customer integrations, tenant isolation, authentication, authorization, and secure onboarding. Establish threat modeling, architecture reviews, CI/CD controls, infrastructure-as-code checks, dependency scanning, SBOMs, container hardening, artifact signing, vulnerability remediation, and release gates. Extend supply-chain controls to models, weights, adapters, datasets, and retrieval sources. Data protection, compliance readiness, and customer trust Define data classification, minimization, retention, deletion, encryption, key management, and approved use of external model providers. Assess vendors and integration risks. Build evidence for enterprise security reviews and prioritize SOC 2 and ISO 27001 readiness, with HIPAA, GDPR, PCI DSS, and other requirements addressed where applicable. Partner with AI and legal leadership on AI risk governance, including NIST AI RMF and ISO/IEC 42001 where appropriate. Detection, incident response, and resilience Establish actionable logging, alerting, vulnerability management, incident procedures, evidence preservation, containment, and recovery. Prepare for conventional security incidents and AI-specific abuse. Conduct tabletop exercises, validate backup and restoration practices, and establish realistic escalation and response coverage for a distributed team. Future deployments and cryptographic readiness Develop security patterns for customer-controlled cloud, on-premises, air-gapped, edge, and field-deployed systems. Address device identity, provisioning, signed updates, physical compromise, intermittent connectivity, revocation, and recovery as products mature. Lead post-quantum readiness through cryptographic inventory, crypto-agility, standards-based migration planning, and interoperability testing. Required Experience Strong, current, hands-on GCP security experience—mandatory. Relevant services include IAM, VPC, KMS, Secret Manager, logging, Cloud Armor, Security Command Center, Cloud Run, GKE, and secure model-serving infrastructure. Practical Microsoft 365 and identity-security capability, including Entra ID, Exchange Online, privileged access, application permissions, and account lifecycle management. Cloud-native, product-security, and DevSecOps depth, including zero trust, APIs, OAuth/OIDC, service authentication, mTLS, containers, Kubernetes, secrets, and secure software delivery. Credible AI-security understanding, including LLM applications, retrieval, agentic workflows, tool permissions, and independently enforced authorization. Advanced model research expertise is not required. Demonstrated security-program ownership, including threat modeling, incident readiness, vulnerability management, audit evidence, and enterprise security discussions. Executive judgment and implementation ability: You can prioritize under resource constraints, challenge unsafe decisions constructively, and translate requirements into working controls. Relevant certifications are welcome, but they do not replace demonstrated delivery. Particularly Valuable Background Early-stage security leadership; AI red teaming and model assurance; email security, phishing/BEC defense, and DLP; regulated-market readiness; private AI deployments; telecom/wireless environments; embedded systems, robotics, or operational technology; and post-quantum migration. We do not expect deep specialization in every future domain. We do expect sound judgment, clear recognition of capability gaps, and the ability to build the right team as we grow. Engagement and Compensation Accord Intelligence is bootstrapped, with an initial angel/family-office financing round underway. The proposed initial engagement is fractional and equity-based, with no cash salary currently budgeted before funding, subject to applicable law, agreed terms, and required approvals. Equity, vesting, responsibilities, weekly commitment, and escalation expectations will be discussed before engagement. We intend to transition the position into a salaried, full-time executive role when financing and business needs support it. Funding, timing, compensation, and conversion are not guaranteed. This opportunity suits an experienced security leader seeking substantive founding responsibility—not a title-only or occasional advisory position. Previous applicants are encouraged to reapply against this updated scope. Individual applicants only. No recruitment agencies, staffing firms, outsourced CISO services, or consulting-company proposals.