Chief Information Security Officer

Namely; South San Francisco (CA); On-site; USD 250,000 - 350,000; Full time

Job summary

Zipline seeks a Chief Information Security Officer to own company-wide security and privacy strategy, leading a lean team across product and corporate security. You will focus on the most consequential risks, then build the capabilities, controls, and operating model that scale with Zipline, while staying hands-on to solve critical problems.

You will define and communicate a clear company-wide security strategy, align leaders around it, and drive remediation decisions with engineering, IT,

Qualifications

• Experience as a CISO, VP of Security, or equivalent leader accountable for both security strategy and hands-on execution.
• Leadership experience in information security, product security, or security engineering within a highly technical organization operating at scale.
• A software engineering foundation, including experience building production software, security systems, or technical controls.
• Technical depth across application, infrastructure, cloud, identity, data, and software security.
• Experience securing safety-critical or cyber-physical systems, such as embedded, robotics, aerospace, automotive, or industrial technology.
• Experience leading serious security incident response and assessing threats from sophisticated external attackers.
• Judgment balancing security, privacy, legal obligations, safety, engineering velocity, customer needs, and business objectives while working directly in a lean team.

Responsibilities

• Set security and privacy strategy, risk posture, roadmap, operating model, and investment priorities across product, infrastructure, data, corporate technology, and physical systems.
• Identify and sequence the company’s highest‑consequence risks, driving clear remediation decisions with Engineering, IT, Legal, Safety, Operations, and Physical Security.
• Advise executives and the board on material security and privacy risks, translating technical findings into business tradeoffs and investment decisions.
• Lead a software security engineering team that contributes production fixes, reusable platforms, and controls that eliminate systemic vulnerability classes.
• Establish security architecture and practices for identity, access control, secrets, data protection, applications, cloud infrastructure, embedded software, aircraft, and field infrastructure.
• Lead threat modeling, testing, vulnerability management, incident response, and security reviews; measure risk coverage, remediation, readiness, control effectiveness, and secure‑engineering adoption.

Skills

CISO leadership

Security strategy

Security engineering

Software security

Threat modeling

Incident response

Risk assessment

Job description

About Zipline

Zipline is the world’s largest and most experienced drone delivery service. We are on a mission to serve all humans equally by ensuring access to food, medicine and essential goods anytime, anywhere. We design, build, and operate the world’s largest autonomous logistics system, delivering critical supplies quickly and reliably. Today, Zipline operates on four continents, makes a delivery somewhere in the world every 30 seconds, and has completed millions of deliveries to date, including blood, vaccines, medical supplies, food, and retail products.

Our customers include the world’s largest and most prominent healthcare systems, governments, retailers, restaurants and global businesses who rely on us to save lives, reduce emissions, increase economic opportunity, and provide delivery from point A to point B as fast as possible. The drone is only 15% of what we’ve built to enable seamless, reliable, global operations.

Our system strengthens supply chains, reduces congestion, and gives people time back. With more than 140 million commercial autonomous miles safely flown, Zipline is redefining access to healthcare, consumer products, and food across the globe.

We operate at a global scale and are looking for practical problem solvers who thrive on real-world challenges and rapid growth. Our team is motivated by building systems that have a direct, meaningful impact on people’s lives and by scaling the future of logistics. We are seeking people who sculpt from first principles, enjoy facing adversity, and can do the impossible at record breaking speeds.

About You and The Role

Zipline operates autonomous delivery systems spanning cloud services, customer and operational data, embedded software, aircraft, and field infrastructure. Security must protect those systems, customers, partners, and the people who rely on them while enabling engineering teams to deliver safely and quickly.

As Chief Information Security Officer, you will own company-wide security and privacy strategy and lead a lean, technical organization across product and corporate security. You will first focus the company on its most consequential risks and remediation decisions, then build the engineering capabilities, controls, and operating model that scale with Zipline. You can define and communicate a clear company-wide security strategy, align leaders around it, and remain hands‑on in solving the most important problems.

What You'll Do

• Set security and privacy strategy, risk posture, roadmap, operating model, and investment priorities across product, infrastructure, data, corporate technology, and physical systems.
• Identify and sequence the company’s highest‑consequence risks, driving clear remediation decisions with Engineering, IT, Legal, Safety, Operations, and Physical Security.
• Advise executives and the board on material security and privacy risks, translating technical findings into business tradeoffs and investment decisions.
• Lead a software security engineering team that contributes production fixes, reusable platforms, and controls that eliminate systemic vulnerability classes.
• Establish security architecture and practices for identity, access control, secrets, data protection, applications, cloud infrastructure, embedded software, aircraft, and field infrastructure.
• Lead threat modeling, testing, vulnerability management, incident response, and security reviews; measure risk coverage, remediation, readiness, control effectiveness, and secure‑engineering adoption.

What You'll Bring

• Experience as a CISO, VP of Security, or equivalent leader accountable for both security strategy and hands‑on execution.
• Leadership experience in information security, product security, or security engineering within a highly technical organization operating at scale.
• A software engineering foundation, including experience building production software, security systems, or technical controls.
• Technical depth across application, infrastructure, cloud, identity, data, and software security.
• Experience securing safety‑critical or cyber‑physical systems, such as embedded, robotics, aerospace, automotive, or industrial technology.
• Experience leading serious security incident response and assessing threats from sophisticated external attackers.
• Judgment balancing security, privacy, legal obligations, safety, engineering velocity, customer needs, and business objectives while working directly in a lean team.

What Else You Need To Know

The starting cash range for this role is $250,000 - $350,000; please note that this is a target, starting cash range for a candidate who meets the minimum qualifications for this role. We are always open to negotiation. The final cash pay for this role will depend on a variety of factors, including a specific candidate's experience, qualifications, skills, working location, and projected impact. The total compensation package for this role may also include: equity compensation; overtime pay; discretionary annual or performance bonuses; sales incentives; benefits such as medical, dental and vision insurance; paid time off; and more.

Zipline is an equal opportunity employer and prohibits discrimination and harassment of any type without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws or our own sensibilities.

We value diversity at Zipline and welcome applications from those who are traditionally underrepresented in tech.

Voluntary Self-Identification

For government reporting purposes, we ask candidates to respond to the below self-identification survey. Completion of the form is entirely voluntary. Whatever your decision, it will not be considered in the hiring process or thereafter. Any information that you do provide will be recorded and maintained in a confidential file.

As set forth in Zipline ’s Equal Employment Opportunity policy, we do not discriminate on the basis of any protected group status under any applicable law.