Head of Security, Eight Sleep

• 8-10+ years of experience in security engineering, with deep expertise in mobile app security, IoT device security, or cloud infrastructure security
• Proven expertise in cybersecurity, cloud infrastructure security (AWS), IoT device security, and corporate risk management
• Experience in consumer technology, health tech, or regulated industries is highly desirable
• Strong knowledge of compliance standards (SOC 2, ISO 27001, HIPAA, GDPR, etc.)
• Excellent communication and stakeholder management skills
• Ability to balance risk with business agility in a fast-paced startup environment

Desirable

• The Head of Security and Compliance will be responsible for building and leading Eight Sleep’s security strategy across physical, digital, and operational domains
• This leader will ensure the confidentiality, integrity, and availability of our data, systems, and devices, while also protecting our employees and customers
• This is a highly cross-functional role requiring collaboration with engineering, product, legal, operations, and executive leadership
• Oversight and implementation, operation and monitoring of information security tools and processes in customer production environments
• Responsible for conducting IT risk assessments, documenting identified threats and maintaining risk register
• Communicates information security risks to executive leadership
• Reports information security risks annually to Eight Sleep leadership and gains approvals to bring risks to acceptable levels
• Define and own Eight Sleep’s end-to-end security strategy across cloud, product, corporate, and customer environments
• Serve as the primary security advisor to the executive team—translating risk into clear business decisions and helping set the company’s security posture and risk tolerance
• Build and scale Eight Sleep’s security program, including roadmap, processes, metrics, and future team structure
• Oversee security architecture and practices for software, cloud infrastructure, connected devices (IoT), and data storage
• Ensure compliance with security frameworks (e.g., SOC 2, GDPR, HIPAA)
• Lead vulnerability management, threat detection, and incident response
• Develop protocols for access management, disaster recovery, and crisis response
• Partner with engineering and product teams to embed security-by-design into all Eight Sleep products
• Guide threat modeling for cloud services, mobile apps, and hardware/firmware components
• Implement privacy and security controls that protect customer data and build trust
• Conduct penetration tests, risk assessments, and security audits
• Lead Eight Sleep’s compliance programs (e.g., SOC 2, GDPR) and partner with legal on privacy obligations
• Establish policies, training programs, and awareness initiatives across the organization
• Lead third-party risk management and vendor security reviews
• Stay ahead of evolving global regulations around data privacy and security