Director of Cybersecurity

Zipline•South San Francisco, CA

2d•$230,000 - $300,000•Onsite

About The Position

Zipline is seeking a Director of Cybersecurity to own company-wide information security and privacy strategy and lead a lean, technical organization across application, product, and corporate security. Zipline’s autonomous delivery systems span cloud services, customer and operational data, embedded software, aircraft, and field infrastructure. The role will focus on the company’s most consequential risks and remediation decisions, then build the engineering capabilities, controls, and operating model needed to scale security as the company grows. The Director will define and communicate a company-wide security strategy, align leaders around it, and work directly with engineers to build and operate security capabilities that address priority risks. The role is based onsite in Zipline’s South San Francisco office five days a week. The role may grow in scope and organizational leadership as the company’s needs evolve.

Requirements

Proven senior leadership experience in a highly technical, fast-paced organization, including operating at scale and leading security through rapid growth.
Demonstrated experience owning security strategy and hands-on execution across information security, product security, or security engineering.
A software engineering foundation, including experience building production software, security systems, or technical controls.
Technical depth across application, infrastructure, cloud, identity, data, and hardware security.
Experience securing safety-critical or cyber-physical systems, such as embedded, robotics, aerospace, automotive, or industrial technology.
Experience leading serious security incident response and assessing threats from sophisticated external attackers.
Sound judgment balancing security, privacy, legal obligations, safety, engineering velocity, customer needs, and business objectives while working directly in a lean team.

Responsibilities

Set security and privacy strategy, risk posture, roadmap, operating model, and investment priorities across product, infrastructure, data, corporate technology, and physical systems.
Identify and sequence the company’s highest-consequence risks and drive remediation decisions with Engineering, IT, Legal, Safety, Operations, and Physical Security.
Help engineering teams move quickly and securely by clarifying tradeoffs, finding practical ways to reduce risk, and building tools and processes that make secure development easier.
Communicate material security and privacy risks to company leaders and partners, translating technical findings into business tradeoffs and investment decisions.
Lead a software security engineering team that owns production security capabilities, contributes fixes and reusable platforms, and works alongside Engineering to eliminate systemic vulnerability classes.
Build and develop a high-performing team through hiring, coaching, setting clear expectations, and direct performance management.
Establish security architecture and practices for identity, access control, secrets, data protection, applications, cloud infrastructure, embedded software, aircraft, and field infrastructure.
Lead threat modeling, testing, vulnerability management, incident response, and security reviews.
Measure risk coverage, remediation, readiness, control effectiveness, and secure-engineering adoption.