Manager, Security

Formation Bio is a tech and AI driven pharma company differentiated by radically more efficient drug development.

Advancements in AI and drug discovery are creating more candidate drugs than the industry can progress because of the high cost and time of clinical trials. Recognizing that this development bottleneck may ultimately limit the number of new medicines that can reach patients, Formation Bio, founded in 2016 as TrialSpark Inc., has built technology platforms, processes, and capabilities to accelerate all aspects of drug development and clinical trials. Formation Bio partners, acquires, or in-licenses drugs from pharma companies, research organizations, and biotechs to develop programs past clinical proof of concept and beyond, ultimately helping to bring new medicines to patients. The company is backed by investors across pharma and tech, including a16z, Sequoia, Sanofi, Thrive Capital, John Doerr, Spark Capital, SV Angel Growth, and others.

You can read more at the following links:

At Formation Bio, our values are the driving force behind our mission to revolutionize the pharma industry. Every team and individual at the company shares these same values, and every team and individual plays a key part in our mission to bring new treatments to patients faster and more efficiently.

About this Role & Why it Matters

You will lead security, reporting to the Director of Technical Operations and working closely with the CTO’s organization. You will stay hands-on across data, cloud, application, and corporate security, lead incident response, and build and manage a small security engineering team. You will join the on-call rotation and use AI tools daily to build and maintain your work.

Security at Formation Bio protects clinical and patient data, the AI systems we build, and the applications our teams create every day. We are building an AI-native company, so security here is an engineering partnership, not a gate.

Key Responsibilities

• Lead incident response end to end, from triage and severity calls through containment, recovery, stakeholder communication, and post-incident reviews, and follow corrective actions through to closure. Join the on-call rotation, with the Director of Technical Operations as escalation.
• Stay hands-on in data, cloud (AWS and GCP), application, and corporate security, reviewing architecture, configuration, code, and pipelines with engineering teams and helping push fixes through to completion.
• Own data security for regulated clinical and patient data and for data used by AI systems, including access, classification, handling, and sharing controls.
• Secure our AI platform and agentic workflows: agent and service identity, credential and secrets handling, MCP connectors and tool permissions, and guardrails for AI agents that act on data and systems.
• Set guardrails and review paths for citizen-built applications so builders keep moving while risk stays managed.
• Operate and tune SIEM, EDR, and vulnerability management, and keep alerting and paging sustainable for an on-call team.
• Use AI tools to build and maintain detection, triage, and security automation, and hold that work to the same review and testing standards as code.
• Verify that controls work through detection tests, tabletop exercises, and assessments, and confirm fixes before closing findings.
• Run a risk-based security roadmap and lead security projects from scoping through delivery.
• Manage the security tooling and services budget, renewals, and vendor performance, and report to the Director and CTO each quarter on posture, material risks, and decisions needed.
• Keep governance lightweight and practical (risk register, policies, exceptions, AI governance), with controls and automated evidence that support GxP, HIPAA, and 21 CFR Part 11 obligations and make audit readiness routine.
• Partner with engineering, Enterprise AI, infrastructure, IT, and CSV as a technical peer, and drive security awareness using observed risks and incidents.
• Hire, coach, and manage security engineers with clear expectations, documented development plans, and growth paths.

Qualifications

Required

• 5+ years in security engineering or security operations, with hands-on depth in data, cloud, and application security.
• Led incident response to resolution and made independent severity calls under pressure.
• Reads and writes code and has partnered with engineers on secure design, remediation, and pipeline security.
• Uses AI tools daily and understands how to secure AI-enabled systems.
• Hands-on with SIEM, EDR, vulnerability management, and security automation.
• Has owned security tooling, budget, and vendor relationships.

Preferred

• Direct people-management experience, including feedback, development, and hiring.
• Experience with agentic identity and security, MCP integrations, or citizen-built application governance.
• Regulated-industry experience (life sciences, healthcare, fintech).
• Familiarity with HIPAA, GxP, and 21 CFR Part 11.

Who We Are Looking For

You are a builder at heart. You keep scope large and teams small, earn engineers’ trust through technical depth, and challenge assumptions with evidence. You use AI as a baseline in your own work and can secure the agentic systems and citizen-built applications our teams are creating. You are comfortable writing the playbook as you go, and you want to show that pharma can run on a modern, tech-first security culture.

What Success Looks Like

First 30 days

• Learn the environment: regulated data flows, the AI platform and agent workflows, citizen-built applications, cloud accounts, and current controls and tooling.
• Join the on-call rotation and validate escalation paths.
• Complete a gap analysis across data, cloud, application, and corporate security covering open risks, control gaps, and audit readiness.
• Prioritize the security work and agree on the roadmap with the Director.

At 3 months

• Baseline detection coverage, response time, vulnerability remediation, and control health, and tune alerting so on-call is sustainable.
• Ship the first high-priority fixes from the gap analysis with engineering teams, with emphasis on data security and cloud infrastructure.
• Ensure material control gaps have accountable owners and timelines.
• Run a tabletop exercise and the first round of control verification tests.
• Establish operating cadences for stakeholder communication, risk tracking, and quarterly reporting.

At 6 months

• Lead security incidents and routine operational decisions independently, with clear escalation of material business, legal, or regulatory risks.
• Show measurable improvement against the 90-day baselines in detection coverage, response performance, and vulnerability remediation.
• Make audit and assessment readiness a sustained operating practice with less last-minute effort and clearer evidence ownership.
• Have AI-assisted security automation in production that reduces manual work, with guardrails in place for agentic identity, MCP connectors, and citizen-built applications.
• Ensure every direct report has clear expectations and a documented development plan.

Total Compensation Range: $185,500 - $232,000

Compensation Individual compensation is determined by several factors, including role scope, geographic location, and skills & experience. Your offer will reflect where you fall within the range based on these considerations. In addition to base salary, we offer equity, comprehensive benefits, and generous perks. If the posted range doesn't match your expectations, we still encourage you to apply!

Where We Hire Formation Bio is prioritizing hiring in key hubs, primarily the New York City and Boston metro areas, with a hybrid model requiring 3 days per week in office. Applicants from the Research Triangle (NC) and San Francisco Bay Area may also be considered. Please apply only if you reside in these locations or are willing to relocate.

Equal Opportunity Formation Bio is committed to building a diverse and inclusive team. We are an equal opportunity employer and welcome candidates from all backgrounds. All qualified applicants will receive consideration for employment without regard to race, color, creed, religion, national origin, ancestry, sex (including pregnancy, childbirth, breastfeeding, and related medical conditions), gender identity or expression, sexual orientation, age, disability, genetic information, marital status, military or veteran status, or any other characteristic protected by federal, state, or local law.

Voluntary Self-Identification

For government reporting purposes, we ask candidates to respond to the below self-identification survey. Completion of the form is entirely voluntary. Whatever your decision, it will not be considered in the hiring process or thereafter. Any information that you do provide will be recorded and maintained in a confidential file.

As set forth in Formation Bio’s Equal Employment Opportunity policy, we do not discriminate on the basis of any protected group status under any applicable law.

If you believe you belong to any of the categories of protected veterans listed below, please indicate by making the appropriate selection. As a government contractor subject to the Vietnam Era Veterans Readjustment Assistance Act (VEVRAA), we request this information in order to measure the effectiveness of the outreach and positive recruitment efforts we undertake pursuant to VEVRAA. Classification of protected categories is as follows:

A "disabled veteran" is one of the following: a veteran of the U.S. military, ground, naval or air service who is entitled to compensation (or who but for the receipt of military retired pay would be entitled to compensation) under laws administered by the Secretary of Veterans Affairs; or a person who was discharged or released from active duty because of a service-connected disability.

A "recently separated veteran" means any veteran during the three-year period beginning on the date of such veteran's discharge or release from active duty in the U.S. military, ground, naval, or air service.

An "active duty wartime or campaign badge veteran" means a veteran who served on active duty in the U.S. military, ground, naval or air service during a war, or in a campaign or expedition for which a campaign badge has been authorized under the laws administered by the Department of Defense.

An "Armed forces service medal veteran" means a veteran who, while serving on active duty in the U.S. military, ground, naval or air service, participated in a United States military operation for which an Armed Forces service medal was awarded pursuant to Executive Order 12985.