Head of Security

IPRally builds AI tools for patent search and analysis. Patent offices, large companies and law firms use our products to work with confidential technical information, often before inventions become public. Protecting that information and earning our customers' trust is fundamental to our business.

We hold ISO 27001 certification and a SOC 2 Type II report and already have an established security program. We're looking for a Head of Security to take ownership of it, strengthen our technical security capabilities and help us navigate the evolving security challenges of AI.

This is a hands-on role with considerable ownership. You'll work closely with our engineers and other teams, taking responsibility for security priorities while doing much of the technical work yourself. We value practical solutions, good judgment and effective use of automation over adding unnecessary processes.

What you'll do

• Own and develop our security program. Maintain and improve our ISMS, lead ISO 27001 and SOC 2 audits, manage security risks and support the development of our AI management practices, including ISO 42001.

• Strengthen product and application security. Work closely with our engineering teams on secure design, threat modelling, vulnerability management and security testing. Help maintain effective security practices as AI agents take on more implementation work.

• Improve cloud and infrastructure security. Partner with Platform Engineering to identify risks, review architecture and access controls, and ensure that security is considered as our infrastructure evolves.

• Shape how we secure AI. Assess and mitigate risks related to LLMs, AI agents and integrations with customers' tools, including prompt injection, data exposure and excessive permissions. Help establish safe practices for using AI tools internally.

• Lead security incident readiness and response. Develop our detection and response capabilities, coordinate incidents and ensure that our business continuity and recovery practices remain effective.

• Build and maintain customer trust. Support security reviews, customer audits and questionnaires, work with Legal on relevant regulatory requirements, and oversee vendor security risks.

• Make security work smarter. Use AI tools, automation and practical engineering solutions to reduce repetitive work and help a small organisation maintain strong security standards.

You'll also work with our IT manager on internal security practices and communicate security priorities, risks and progress to company leadership.

What we're looking for

You could be a strong fit if you:

• Have at least five years of hands-on experience in security engineering, cloud security, application security or a similar role, ideally in a SaaS or cloud environment.

• Have strong technical knowledge of cloud and application security, including authentication, authorization, common vulnerabilities and secure software design.

• Have hands-on experience with security frameworks such as ISO 27001 or SOC 2, including audits, and know how to turn compliance requirements into practical security improvements.

• Have experience identifying, prioritizing and resolving security vulnerabilities, and have participated in or led security incident response.

• Understand the security challenges introduced by LLMs and AI agents and can help engineering teams address them.

• Are comfortable using AI tools and automation to improve your work without compromising security.

• Can work independently, make pragmatic decisions based on risk and drive improvements together with engineering teams.

• Communicate clearly with technical and nontechnical stakeholders, including customers, auditors and company leadership.

Nice to have

• Experience leading or developing a security function in a smaller company.

• Familiarity with ISO 42001, NIS2, the EU AI Act or the Cyber Resilience Act.

• Experience working with regulated industries, public sector customers or highly confidential data.

• Knowledge of search, ML systems or the security of AI powered products.

• Practical experience with internal IT security, identity management or device security.

Why IPRally?

You'll join a company where security is already an established priority, rather than something you need to introduce from scratch.

At the same time, there's plenty of room to make things better. You'll have direct influence over our security practices, work closely with the people building our products and help us navigate security challenges at the intersection of software engineering and AI.

We're small enough that you can make decisions quickly and see the impact of your work across the company.

Location: we prefer candidates based in Helsinki or elsewhere in Finland.

Salary: €6000-7000/month, with equity.