Company Overview

The company operates a marketing SaaS platform leveraging LINE. As a rapidly growing startup, it utilizes AI technologies to help brands build sustainable and trustworthy relationships with their customers.

In addition to its LINE marketing tools, the company develops and provides a range of services, including LINE 1-to-1 business chat, digital membership card LINE mini apps, and AI-powered call solutions.

■Key Features

• Operates in the C-commerce market, which is estimated to be worth nearly JPY 30 trillion globally and is projected to surpass the e-commerce market in certain countries by 2025
• Achieved 760% business growth over the past three years in the marketing SaaS domain
• Successfully raised a total of JPY 6.3 billion in funding (including JPY 3.5 billion in Series B)
• Ranked No.1 in LINE marketing in Japan
• A global organization with offices overseas and team members representing 20 different nationalities

 

Job Description

Overview

The company has been building its security foundation by reallocating internal resources and establishing key security functions, including assigning dedicated security personnel, developing security policies and processes, and implementing and maintaining ISMS and PrivacyMark frameworks.

The necessary foundations for further developing its security capabilities are now in place, including executive sponsorship, dedicated budget allocation, and the integration of security initiatives into company-wide objectives.

The next step is to evolve these initiatives into a dedicated Security Engineering function. This position will lead the establishment and ongoing operation of this function, including organizational development and the execution of the company’s security strategy.

The company’s vision for security goes beyond simply eliminating vulnerabilities and ensuring compliance with established rules. It aims to ensure that AI agents can operate autonomously and securely, that AI-assisted software development is safe by design, and that customers can use its services with confidence.

The mission of this role is to embed these principles into both the products and development processes, transforming security into a competitive advantage that supports business growth.

Key Responsibilities

1. Security Strategy and Organizational Development

• Develop and execute a company-wide security strategy and roadmap across all products, including Engage AI, Voice AI, BizClo, and Micomii, as well as define and implement company-wide security objectives on a semiannual basis.
• Prioritize security risks and develop budget and resource plans. Evaluate and select security tools and external vendors, including Build vs. Buy decisions and ROI assessments.
• Establish and lead the Security Engineering function, including recruiting, developing, and evaluating security engineers.
• Build a global security team spanning Japan, India, and other regions, and design organizational structures and processes that can scale with business growth.

2. Product Security / Application Security

• Promote Security by Design and establish structured processes for threat modeling and secure design reviews.
• Integrate SAST, SCA, and secret detection into CI/CD pipelines, and automate security scanning and code review processes.
• Design and operate vulnerability management processes, and plan and conduct both internal and external penetration tests.

3. AI / LLM Security

• Design security guardrails governing AI agent permissions, tool execution, and data access.
• Design and conduct adversarial testing and AI Red Teaming, and establish security release criteria for AI agents.
• Develop security policies for AI-assisted software development.
• Conduct threat analysis using frameworks such as OWASP LLM Top 10 and MITRE ATLAS, and enhance security operations through the use of AI.

4. Governance, Risk, and Compliance (GRC) / Data Protection

• Manage and enhance existing ISMS (ISO 27001) and PrivacyMark programs, and prepare for additional frameworks such as SOC 2.
• Develop security policies and standards, and establish risk assessment and management processes.
• Build data protection frameworks in line with APPI and GDPR requirements, including data classification, least-privilege access controls, masking, and tokenization, in collaboration with Legal and Compliance teams.

5. Customer Trust

• Respond to customer security assessments, audits, and questionnaires, and develop and maintain security documentation.
• Establish external-facing initiatives, such as a Trust Center, to communicate the company’s security practices and capabilities to customers.
• Engage with enterprise customers, clients in regulated industries, audit firms, and, where necessary, regulatory authorities.

6. Incident Response

• Establish and conduct training for incident response frameworks and processes, and develop detection and monitoring capabilities.
• Define company-wide security baselines and lead technical decision-making and incident coordination when security incidents occur.

Team Structure and Working Style

• Starting with a two-person team: The Security Engineering function will initially be established around this position and a Senior-to-Lead-level Security Engineer to be recruited in India. The team is expected to expand in line with business growth.
• Direct reporting to the VPoE: This role will work closely with the VPoE on security strategy, organizational development, budgeting, and roadmaps. The position will also participate in discussions with executive leadership, customers, and, when necessary, regulatory authorities alongside the VPoE.
• Collaboration with engineering teams: Each development team will have designated security representatives who work with the Security Engineering team to integrate security into development workflows. This role is expected to design the frameworks, standards, priorities, and timelines that enable individual teams to improve their security capabilities autonomously.
• Hands-on leadership: In addition to management responsibilities, this position is expected to remain technically involved in areas such as reviewing threat models, developing AI agents and internal security infrastructure, evaluating third-party security solutions, designing tenant isolation architectures, and reviewing AI Red Teaming results.

Scope Clarification

This position is not intended to be the sole individual responsible for the company’s overall security accountability, which will ultimately be shared with the VPoE. It does not include general internal IT or corporate IT administration responsibilities, nor is it limited to audit and compliance activities.

The company is looking for someone who can actively build, operate, and institutionalize security capabilities, ensuring that they can be sustained and continuously improved as an organizational function.

Expectations for This Role

• Bridging Technology and Business: Develop a broad understanding of Application Security, Infrastructure Security, and GRC, and translate technical decisions into business-relevant insights for management, business teams, and customers.
• Building an Organization from the Ground Up: Independently identify what is needed and design and establish the organizational structure, roles, processes, and recruitment plans required to build the function.
• Making Decisions in Emerging and Uncertain Areas: Evaluate AI agents and AI-assisted development from both technical and risk perspectives, making sound decisions in areas where established best practices are still evolving.
• Maximizing Impact with a Lean Team: Leverage AI, automation, and close collaboration with development teams to maximize security coverage and effectiveness with a relatively small team.

What Makes This Opportunity Attractive

• Build a Security Engineering Function from the Ground Up: Take ownership and shape the organization, recruitment, budget, roadmap, technical infrastructure, and development processes, with significant autonomy to establish the function.
• Work at the Forefront of Security in the AI Era: Address emerging challenges surrounding autonomous AI agents and AI-driven development processes, contributing to security practices in an evolving field.
• Work Closely with Executive Leadership and Business Teams: Collaborate directly with the VPoE and drive security initiatives as a strategic business, customer, and management priority.
• Make a Significant Business Impact: Help protect products used by more than 5,500 companies, including customers in regulated industries, as well as the end users who rely on these services.
• Work in a Global Environment: Collaborate with multinational teams across India, the Philippines, Taiwan, and other regions, with the opportunity to develop the Security Engineering function into a global organization.

Potential Career Development

This position offers the opportunity to gain experience leading company-wide security initiatives that extend beyond technical security expertise to encompass organizational development, budgeting, executive management, business strategy, and customer relationships.

As the Security Engineering function grows, the successful candidate may have the opportunity to lead a global security organization and potentially progress toward a CISO role with direct involvement in executive-level business and strategic decision-making.

 

Requirements

Required Qualifications

• 10+ years of professional experience in cybersecurity: Including at least 3–5 years of experience leading security engineers or teams within a software product organization or a comparable environment, with end-to-end ownership of security programs. Experience limited to network security or internal IT security is not sufficient.
• Leadership experience across both Product Security and GRC: Hands-on experience leading both Application Security (AppSec), SAST/SCA, vulnerability management, and penetration testing, as well as certification programs, customer audits, and governance frameworks such as ISO 27001 and SOC 2.
• Technically credible, hands-on leadership: Ability to actively review code and architecture, conduct threat modeling, and assess the actual risk and impact of vulnerabilities. Proven experience building security capabilities through direct technical involvement while leading a team.
• Practical experience in cloud security and DevSecOps: Experience with cloud security, particularly AWS, integrating security into CI/CD pipelines, and establishing and operating a Secure SDLC within a multi-tenant SaaS environment.
• Knowledge of and interest in AI / LLM security: Understanding of threats such as prompt injection, jailbreaks, and tool misuse, as well as approaches to securing AI agents based on frameworks such as OWASP LLM Top 10 and MITRE ATLAS. Deep specialization in this area can be further developed after joining; the ability to identify and assess emerging risks is particularly important.
• Experience with enterprise customers and regulated industries: Proven experience engaging as a security leader with enterprise clients, customers in regulated industries, auditors, and, where necessary, regulatory authorities.
• Practical experience using AI coding agents: Regular use of AI coding agents such as Claude Code in day-to-day work, along with a strong interest in AI-native development processes and their security implications.
• Bilingual proficiency in Japanese and English: Fluency in either Japanese or English, with professional working proficiency in the other language. The engineering organization consists of multinational members across more than 20 countries, primarily in India and Japan.

Preferred Qualifications

• Security leadership experience in regulated industries.
• Deep understanding of APPI and GDPR, with experience establishing data protection programs covering data classification, masking, tokenization, and least-privilege access controls.
• Experience establishing a security team or function from near zero, such as serving as an early-stage security leader or founding CISO.
• Experience embedding security practices across multiple development teams.
• Experience leading the acquisition and maintenance of certifications such as SOC 2 and PrivacyMark.
• Experience building incident response frameworks and security detection infrastructure.
• Experience managing security budgets, selecting vendors, and evaluating ROI.
• Experience managing global, multinational, and distributed teams, including remote teams.
• Relevant professional certifications such as CISSP, CISM, CCSP, OSCP, GWAPT, or Registered Information Security Specialist (RISS). Certifications are considered an advantage but do not substitute for practical experience.
• Business-level Japanese communication skills.

Ideal Candidate Profile

• A builder of systems and teams: Someone who focuses not only on identifying individual vulnerabilities but also on building the systems that continuously detect them and the teams that improve those systems over time. Able to turn individual decisions into standardized policies, processes, and tools that continue to function independently of any one person.
• Able to make security an enabler of development speed: Someone who understands weekly releases as a company-wide commitment and can balance strong security standards with rapid development and delivery.
• Able to bridge technology and executive leadership: Someone who can communicate the same security risk in different terms, explaining its technical background and countermeasures to engineers while presenting its business impact and priorities to executives, and effectively influencing both.
• Comfortable building from the ground up: Someone who enjoys identifying what is missing, creating new structures and processes, and continuously improving them in an evolving environment.
• Views security as a source of customer value: Someone who recognizes that customers’ confidence in using the company’s products is itself a key part of product value, and can build that trust through technology, organizational capabilities, and well-designed processes.

 

Compensation & Benefits

Salary: JPY 11,000,000 〜JPY 18,000,000per year
Probation Period: 3 months

Location
The position is based in either Tokyo or Osaka, depending on the candidate’s preference. Fully remote arrangements can be discussed on a case-by-case basis.

The company offers a flexible hybrid work style, combining remote work with office attendance. Frequency of office visits varies, typically ranging from once a week to once a month.

Working Hours

• Standard hours: 9:00 AM – 6:00 PM (includes a 1-hour break; overtime may be required)
• Flexible working hours with core time from 10:00 AM – 4:00 PM
• For employees above a certain grade, a discretionary labor system applies according to company policy

Holidays & Leave

• Saturdays, Sundays, and public holidays
• New Year’s holidays
• Summer vacation
• Bereavement leave
• Paid leave (10 days granted upon joining, with additional days accrued based on length of service)
• Other holidays as specified by company regulations

Benefits & Perks

• Commuting allowance (bicycle commuting permitted)
• Company-provided laptop
• Company-provided mobile phone (for certain roles only)
• Flexible start time program (can be applied for every 2 months)
• Social insurance coverage (health insurance, employee pension, employment insurance, workers’ compensation)
• Life & health support leave
• Coverage of medical check-up expenses
• Childbirth and childcare support programs
• Club activities and social groups

Measures Against Secondhand Smoke: No Smoking Indoors

 

Hiring Process

• Number of interviews: 3
• Application documents required: Resume / CV
• Interview language: Japanese and English

 

Please note: this position is open to candidates currently residing in Japan.