Head of InfoSec and IT Ops

Zip • San Francisco, CA

10d

About The Position

Zip is seeking a Head of InfoSec and IT Ops to build and lead the enterprise security and IT operations system for Zip at a pivotal stage of scale. Zip operates a mission-critical enterprise SaaS platform, is rapidly expanding operations globally, and is building the governance and controls required for its next phase. This role will own a practical, engineering-oriented program spanning enterprise security governance, corporate security, detection and incident response, compliance and customer trust, and reliable employee technology. The Head of InfoSec and IT Ops will partner closely with Product and Engineering leaders responsible for the platform, and with Business Technology and Internal AI leaders building the systems and automations that run Zip. The initial mandate is to make accountability unambiguous: understand the current program, agree boundaries with existing product/infrastructure security leadership, stabilize IT operations, and turn fragmented risks and services into one measurable operating model. The role involves leading by doing, while hiring and developing the team.

Requirements

• 12+ years across information security, security engineering, IT engineering/operations, risk, or related disciplines
• 5+ years leading teams in a high-growth B2B SaaS company
• Experience owning a broad enterprise security program and partnering deeply with Product/Engineering; credible across both corporate and product risk
• Demonstrated leadership of major incidents, detection/response, vulnerability management, identity, endpoint/SaaS, cloud and secure SDLC programs
• Practical experience with SOC 1/2, ISO 27001, privacy obligations, customer assurance, and audit remediation
• Strong technical judgment: can review architecture, challenge IAM and cloud decisions, understand application/data flows, and distinguish control evidence from real risk reduction
• History of scaling IT service delivery and systems engineering through automation, self-service, clear SLOs, and excellent employee experience
• Ability to create clear decision rights in a federated environment and influence executives and engineering leaders without relying on hierarchy
• Excellent written and incident communication; calm under pressure; high integrity and discretion
• AI-forward and hands-on: understands LLM/agent risks, MCP/tool access, prompt injection, data leakage, excessive agency, evaluations, and governance

Nice To Haves

• Experience at a procurement, fintech/payments, enterprise workflow, or data-sensitive SaaS company
• CISSP/CISM, cloud security, incident response, ISO lead implementer/auditor, or similar evidence of depth—certifications are not substitutes for outcomes
• Experience building an internal audit/SOX readiness program or operating through an IPO
• Experience integrating or consolidating security and IT organizations after leadership change
• SOX/public-company and ISO 42001 experience

Responsibilities

• Own the enterprise security program. Establish strategy, risk appetite, policies, control framework, roadmap, metrics, executive reporting, and decision rights.
• Clarify and operate the product/corporate boundary. Partner with Product Security to define who owns application security, cloud/production security, identity engineering, vulnerability management, detection/response, customer trust, and remediation.
• Lead IT Operations and Engineering. Build a high-quality global service model across support, identity, endpoint, SaaS, collaboration, office/network, automation, asset lifecycle, and resilience. Separate frontline support from systems engineering and drive secure self-service.
• Build detection and response. Define priority threats and crown jewels, improve telemetry and detection coverage, establish 24/7 response, run incidents and exercises, and ensure corrective actions prevent recurrence.
• Own GRC, assurance, and customer trust. Maintain and streamline processes for SOC 1, SOC 2, ISO 27001, and IS 42001, prepare for future SOX/public-company controls, manage audits and findings, and enable fast, accurate customer security responses.
• Secure AI and internal tools. Partner with internal teams to define the risk tolerance, framework, and infrastructure to securely deploy AI and business apps built in-house.
• Drive EIAM and data protection. Mature joiner/mover/leaver, privileged access, service identities, access reviews, data classification, DLP, encryption/key management, retention/deletion, and sensitive-data controls.
• Manage third-party and resilience risk. Mature TPRM by risk-tiering vendors, ensuring contractual and operational controls, defining service criticality/RTO/RPO, and maintaining crisis readiness.
• Build the team and culture. Assess roles and capability gaps, hire selectively, develop leaders, create security/IT champions, and make the safe path the easy path.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed