Senior Director, Information Security

Zillow Group Inc.; Bengaluru; On-site; INR 6,000,000 - 9,000,000; Full time

Job summary

Zillow Group Inc. is seeking a Sr. Director of Information Security in Bengaluru to drive strategy and maturity across Cyber Defense, Threat Intelligence, AppSec, and Security Architecture. You will lead a multi‑manager organization, align with product and platform teams, and foster an outcomes‑driven security culture.

The role emphasizes a cloud‑native, zero‑trust security model, automation, and executive communication to protect a large real estate platform used by millions.

Qualifications

• 12+ years of progressive security experience with leadership roles.
• Experience owning multiple security domains simultaneously.
• Proven track record in Application Security leadership at scale.
• Deep expertise in multi‑cloud security (AWS preferred), IaC security, Kubernetes/container security, and Zero Trust.

Responsibilities

• Lead and develop a multi‑manager organization across four security domains.
• Establish and execute a 2–3‑year strategic roadmap aligned with product priorities.
• Oversee and mature SOC, security engineering, threat intel, AppSec, and security architecture functions.
• Represent Information Security at the executive level and translate risk into business impact.

Skills

Security leadership

Cloud security (AWS)

Incident response

Threat intelligence

AppSec leadership

Zero Trust

Detection engineering

Executive communication

Scripting (Python/Go)

Education

Bachelor's or MS in CS/CIS/security

Tools

SIEM

SOAR

DLP

EDR

EPM

CSPM/CWPP

IaC (IAC)

Kubernetes security

Job description

About the Team

Zillow’s Information Security team is the engineering-first security organization at the heart of one of the most-visited real estate platforms in the United States. We protect a product ecosystem that drives real estate transactions, safeguards the personal and financial data of millions of customers, and powers a marketplace that is reimagining what it means to come home. We operate like a product engineering team—build, automate, and ship. Our security engineers are embedded partners to the product and platform organizations, not gatekeepers. We move fast, prefer paved roads over guard rails, and treat security as a feature of the product rather than a tax on it. Our work spans cloud-native infrastructure at scale, a high-velocity application development lifecycle, real-time threat detection and response, and a threat intelligence program that informs both defensive and product risk decisions across the company. This is a team where technical credibility matters. Our leaders write strategy documents and review detection logic and SDLC security controls. If you’ve spent your career building things—secure software, detection pipelines, AppSec programs, zero trust architectures—this is the kind of organization you’ve been building toward.

About the Role

As Sr. Director of Information Security, you will drive the strategy, execution, and maturity of four interconnected security disciplines: Cyber Defense (SOC and Security Engineering), Threat Intelligence, Application Security, and Security Architecture. This M6 leadership role reports directly to the VP, CISO, and carries significant accountability for the security posture, talent, and engineering culture of a large, multi‑function organization.

Responsibilities

Leadership & Organizational Strategy

Lead and develop a multi‑manager organization across the four domains, setting clear direction, healthy team culture, and high‑performance expectations at every level.

• Establish and execute a 2–3‑year strategic roadmap tied to Zillow’s product and platform priorities.
• Own workforce planning, org design, talent acquisition, and bench development for future security leaders.
• Manage budget, tooling portfolio, and vendor relationships, focusing on consolidation and automation ROI.
• Represent Information Security at the executive level, translating technical risk into business impact for the CISO.

Cyber Defense (SOC & Security Engineering)

• Oversee and mature the Security Operations Center and Security Engineering function, moving from reactive monitoring to proactive detection engineering and automated response.
• Champion a detection‑as‑code philosophy with custom, high‑fidelity detections tailored to Zillow’s threat model.
• Own the Incident Response program, ensuring rapid containment, strong forensics, and blameless post‑incident review.
• Drive SOAR adoption to reduce MTTR and scale SOC capacity without proportional headcount growth.
• Promote an offensive security mindset through red team and adversarial simulation exercises.

Threat Intelligence

• Build and operationalize a threat intelligence program that informs product risk decisions, detection priorities, and architectural controls.
• Maintain deep integration with SOC, AppSec, and Architecture functions.
• Develop relationships with threat‑sharing communities, law enforcement, and peers for early‑warning visibility.

Application Security

• Lead an AppSec organization that partners with product engineering, embedding security into CI/CD pipelines and developer tooling.
• Drive a developer‑first security culture with enablement programs, secure coding training, and internal tooling.
• Ensure coverage of Zillow’s application portfolio, including secure design review, DAST/SAST integration, dependency management, and API security.
• Own product security strategy, integrating security into design‑time decisions.
• Build and maintain a vulnerability management program with clear SLAs, risk‑based prioritization, and executive reporting.

Security Architecture

• Establish and maintain enterprise security patterns, reference architectures, and guardrails for Zillow’s cloud‑native, AWS‑centric infrastructure.
• Drive Zero Trust principles and identity‑driven access, embedding security into infrastructure‑as‑code and platform primitives.
• Provide proactive guidance in platform and product design reviews to accelerate engineering delivery.
• Maintain a forward‑looking architecture posture by evaluating emerging threats and technologies.

Qualifications

• 12+ years of progressive security experience, with at least 5 years in senior leadership roles managing managers and multi‑functional security teams.
• Roots in security engineering, software development, or platform engineering.
• Demonstrated experience owning multiple security domains simultaneously.
• Proven track record in Application Security leadership at scale.
• Deep expertise in multi‑cloud security (AWS preferred), IaC security, Kubernetes/container security, and Zero Trust architecture.
• Strong detection engineering mindset with experience moving a SOC to custom detection pipelines, SOAR automation, and threat‑model‑driven coverage.
• Ability to quantify and communicate security risk in business and financial terms; experience presenting to executive leadership.
• Talent magnet with a reputation for hiring and developing elite security engineers.
• Familiarity with modern security tooling ecosystem: SIEM, SOAR, DLP, EDR, EPM, CSPM/CWPP, SaST/DaST, IAC, and container security.
• Proficiency in at least one scripting or programming language (Python, Go, or similar).

Benefits & Compensation

Competitive base pay and incentive compensation subject to applicable laws and Zillow policies. Actual amounts vary based on experience, performance, and location. This role is categorized as an Office position; employees will work at the Zillow India office for 80–100% of the month and must live within a reasonable commuting distance.

Equal Employment Opportunity

Zillow Group is an equal opportunity employer committed to fostering an inclusive, innovative environment with the best employees. We are committed to equal employment opportunity regardless of race, color, ancestry, religion, sex, national origin, sexual orientation, age, citizenship, marital status, disability, gender, maternity status, HIV status, or veteran status. Reasonable accommodations will be provided to candidates with disabilities, in accordance with applicable policies.