Head of Security

RevenueCat makes building, analyzing, and growing mobile subscriptions easy. We power monetization for thousands of apps, from small indie developers to some of the largest apps in the world.

Our platform handles billions of events every day and sits in the critical path of our customers’ revenue. Reliability and security are not support functions here. They are core product requirements.

As the world changes with AI, the security landscape is getting significantly more chaotic. Supply chain attacks, credential theft, AI-assisted phishing, malicious packages, fraud, infrastructure attacks… the pace and sophistication of threats are accelerating quickly.

We already have strong foundations:

SOC 2 Type II for several years

A strong infrastructure and reliability culture

A security engineer focused on infrastructure/security operations

Ongoing investment in application security, with a very active bug bounty program

Product and engineering teams that genuinely care about security

Celebrate security awareness month with red team, social attacks and other activities

But we believe the next stage requires dedicated leadership and ownership across the entire security function.

That’s where you come in.

About you

You are a deeply technical security leader who understands how modern engineering organizations actually work.

You know how to improve security without turning the company into a bureaucratic nightmare. You are pragmatic, calm under pressure, and capable of building systems and processes that scale with the company.

You have a strong understanding of both infrastructure and application security. You’ve been involved in real-world security incidents and know how to navigate high-pressure situations with good judgment.

You are comfortable operating with high ownership and ambiguity, and can move between technical details, strategic planning, customer conversations, and incident response without losing context.

You are also excited about building and scaling a strong security organization over time. You know how to recruit great people, raise the bar, and create a security culture that engineers genuinely want to work with.

You have strong opinions on:

Supply chain security

Secure software development

AI-assisted engineering workflows

Infrastructure hardening

Identity and access management

Incident response

Balancing security with engineering velocity

Strong communication skills are important in this role. Experience with AWS, distributed systems, developer tools, fintech, mobile, or payments is a strong plus.

Most importantly, you understand that security is not compliance theater. It is a critical part of the reliability, trust, and long-term survival of the business.

Within 1 month, you’ll…

Learn RevenueCat’s architecture, systems, and operational model

Understand our existing security posture, controls, tooling, and processes

Build relationships across engineering and infrastructure teams

Review our current incident response and escalation practices

Start identifying high-leverage improvements and key risks

Within 3 months, you’ll…

Own and evolve RevenueCat’s security roadmap

Establish clear priorities across infrastructure, application, and internal security

Partner closely with engineering leadership on architecture and security decisions

Evaluate risks and policies around AI-assisted development workflows

Build trust internally as the security leader engineers want to work with, not work around

Within 6 months, you’ll…

Drive meaningful improvements to our overall security posture

Improve detection, prevention, and response capabilities

Improve security education and awareness across the company

Support customer-facing security conversations and reviews

Help define how the security organization should scale over time

Within 12 months, you’ll…

Establish a mature, pragmatic, high-trust security program

Build scalable systems that support both security and engineering velocity

Help RevenueCat stay ahead of the rapidly changing AI-driven threat landscape

Develop a long-term strategy for security, resilience, and operational trust

Be viewed internally as a critical technical and strategic leader across the company