Head of Information Security

Zipline•South San Francisco, CA

4d•$250,000 - $350,000•Onsite

About The Position

Zipline is seeking a Head of Information Security to own company-wide information security and privacy strategy and lead a lean, technical organization across application, product, and corporate security. The role protects Zipline’s cloud services, customer and operational data, embedded software, aircraft, and field infrastructure while enabling engineering teams to deliver safely and quickly. The Head of Information Security will prioritize the company’s most consequential risks and remediation decisions, then build the engineering capabilities, controls, and operating model needed to scale with the company. The role defines and communicates a company-wide security strategy, aligns leaders around it, and works hands-on with engineers to build and operate security capabilities. As Zipline grows, the role may expand in scope and organizational leadership. This position is based in Zipline’s South San Francisco office and requires onsite work five days a week. The starting cash range is $250,000–$350,000. Total compensation may also include equity compensation, overtime pay, discretionary annual or performance bonuses, sales incentives, benefits such as medical, dental, and vision insurance, paid time off, and more.

Requirements

Proven senior leadership experience in a highly technical, fast-paced organization, including operating at scale and leading security through rapid growth.
Demonstrated experience owning security strategy and hands-on execution across information security, product security, or security engineering.
A software engineering foundation, including experience building production software, security systems, or technical controls.
Technical depth across application, infrastructure, cloud, identity, data, and hardware security.
Experience securing safety-critical or cyber-physical systems, such as embedded, robotics, aerospace, automotive, or industrial technology.
Experience leading serious security incident response and assessing threats from sophisticated external attackers.
Judgment balancing security, privacy, legal obligations, safety, engineering velocity, customer needs, and business objectives while working directly in a lean team.

Responsibilities

Set security and privacy strategy, risk posture, roadmap, operating model, and investment priorities across product, infrastructure, data, corporate technology, and physical systems.
Identify and sequence the company’s highest-consequence risks and drive remediation decisions with Engineering, IT, Legal, Safety, Operations, and Physical Security.
Help engineering teams move quickly and securely by clarifying tradeoffs, reducing risk practically, and building tools and processes that make secure development easier.
Communicate material security and privacy risks to company leaders and partners, translating technical findings into business tradeoffs and investment decisions.
Lead a software security engineering team responsible for production security capabilities, fixes, reusable platforms, and partnering with Engineering to eliminate systemic vulnerability classes.
Build and develop a high-performing team through hiring, coaching, clear expectations, and direct performance management.
Establish security architecture and practices for identity, access control, secrets, data protection, applications, cloud infrastructure, embedded software, aircraft, and field infrastructure.
Lead threat modeling, testing, vulnerability management, incident response, and security reviews.
Measure risk coverage, remediation, readiness, control effectiveness, and secure-engineering adoption.