Head of Security

SPAN • San Francisco, CA

3d • $250,000 - $300,000 • Onsite

About The Position

SPAN is a mission-driven company designing, building, and deploying products to electrify the built environment, reduce carbon emissions, and support the clean energy transition. The Head of Security leads the company’s end-to-end security strategy across smart electrical panels, embedded firmware, cloud infrastructure, mobile applications, and enterprise IT. This executive role defines the multi-year security roadmap, manages risk exposure, and safeguards the security, resilience, and privacy of customers’ energy data and critical home infrastructure.

The role works closely with hardware and software engineering teams to embed security throughout product development and operations. It leads product and IoT security, cloud and application security, AI and machine learning security, enterprise security, vulnerability management, incident response, governance, risk and compliance, and supply-chain security. The Head of Security also recruits, mentors, and leads a diverse security organization and communicates security posture, program maturity, and risk to executives and the board.

SPAN is headquartered in San Francisco’s SoMa neighborhood and describes its workplace as collaborative, diverse, and focused on building the future of renewable energy. The position includes competitive compensation and equity, benefits, flexible hours, and flexible time off.

Requirements

• At least 10 years of progressive cybersecurity experience.
• At least 5 years in a security leadership role at a hardware, consumer electronics, IoT, or software-defined product company.
• Deep technical expertise in cloud-native architectures such as AWS or GCP, application security, and connected-device or embedded security.
• Hands-on engineering background and the ability to influence technical teams.
• Demonstrated ability to build, scale, and improve security programs, including both enterprise governance and technical threat modeling.
• Experience communicating technical cyber risks in business terms to C-suite executives, board members, and enterprise partners.
• Strong working knowledge of steering organizations through compliance audits such as SOC 2 and ISO 27001, and implementing data governance and privacy frameworks.
• B.S. or M.S. in Computer Science, Computer Engineering, Cybersecurity, or equivalent practical experience.
• Passion for SPAN’s mission to reinvent the electrical panel, decarbonize the residential sector, and accelerate clean-energy adoption.

Nice To Haves

• Industry-recognized leadership certifications such as CISSP, CISM, or CISA.

Responsibilities

• Define, own, and execute a multi-year enterprise and product security roadmap, translating business objectives, threats, and regulatory requirements into an actionable strategy.
• Present security posture, program maturity, and total risk exposure to executive leadership and the board.
• Partner with hardware, firmware, and platform engineering teams to embed security across product development; oversee threat modeling, penetration testing, and hardware security requirements.
• Secure the over-the-air update pipeline, cryptographic key management, and embedded-system communications.
• Promote security by design for cloud backend services and mobile applications; integrate SAST and DAST tooling into CI/CD pipelines and protect cloud-to-device communications.
• Develop threat models for machine-learning pipelines, protect model integrity against adversarial inputs, and establish data governance and privacy guardrails for AI workloads processing home-energy telemetry.
• Govern enterprise IT security and lead the transition toward Zero Trust architecture, including endpoint defense, identity and access management, and secure network architecture.
• Build and operate a vulnerability management program and lead the Product Security Incident Response Team (PSIRT).
• Establish coordinated disclosure processes, manage bug bounty programs, coordinate third-party red-team engagements, and ensure rapid vulnerability triage and remediation.
• Define and author the enterprise security policy framework and align it with standards such as SOC 2, ISO 27001, and NIST, as well as relevant IoT and energy security standards.
• Oversee supply-chain security, Software Bill of Materials (SBOM) practices, and third-party vendor risk.
• Recruit, mentor, and lead security engineers, architects, and GRC specialists; foster ownership, technical excellence, and collaboration across the global engineering organization.

Benefits

• Competitive compensation and equity grants.
• Medical, dental, and vision coverage with 100% of employee premiums for base plans; options for additional coverage.
• Parental leave up to 24 weeks, depending on eligibility.
• Comfortable, sunny office near BART and Caltrain public transit.
• Employee Resource Groups, monthly social events, SPANcakes recognition breakfast, and lunch-and-learns.
• Flexible hours, one holiday per month, and flexible time off.

What This Job Offers

• Job Type: Full-time
• Career Level: Executive