CISO: Strategy, Security Engineering & Risk Leadership

Namely; South San Francisco (CA); On-site; USD 250,000 - 350,000; Full time

Job summary

Zipline seeks a Chief Information Security Officer to own company-wide security and privacy strategy, leading a lean team across product and corporate security. You will focus on the most consequential risks, then build the capabilities, controls, and operating model that scale with Zipline, while staying hands-on to solve critical problems.

You will define and communicate a clear company-wide security strategy, align leaders around it, and drive remediation decisions with engineering, IT,

Qualifications

• Experience as a CISO, VP of Security, or equivalent leader accountable for both security strategy and hands-on execution.
• Leadership experience in information security, product security, or security engineering within a highly technical organization operating at scale.
• A software engineering foundation, including experience building production software, security systems, or technical controls.
• Technical depth across application, infrastructure, cloud, identity, data, and software security.
• Experience securing safety-critical or cyber-physical systems, such as embedded, robotics, aerospace, automotive, or industrial technology.
• Experience leading serious security incident response and assessing threats from sophisticated external attackers.
• Judgment balancing security, privacy, legal obligations, safety, engineering velocity, customer needs, and business objectives while working directly in a lean team.

Responsibilities

• Set security and privacy strategy, risk posture, roadmap, operating model, and investment priorities across product, infrastructure, data, corporate technology, and physical systems.
• Identify and sequence the company’s highest‑consequence risks, driving clear remediation decisions with Engineering, IT, Legal, Safety, Operations, and Physical Security.
• Advise executives and the board on material security and privacy risks, translating technical findings into business tradeoffs and investment decisions.
• Lead a software security engineering team that contributes production fixes, reusable platforms, and controls that eliminate systemic vulnerability classes.
• Establish security architecture and practices for identity, access control, secrets, data protection, applications, cloud infrastructure, embedded software, aircraft, and field infrastructure.
• Lead threat modeling, testing, vulnerability management, incident response, and security reviews; measure risk coverage, remediation, readiness, control effectiveness, and secure‑engineering adoption.

Skills

CISO leadership

Security strategy

Security engineering

Software security

Threat modeling

Incident response

Risk assessment

Job description

Zipline seeks a Chief Information Security Officer to own company-wide security and privacy strategy, leading a lean team across product and corporate security. You will focus on the most consequential risks, then build the capabilities, controls, and operating model that scale with Zipline, while staying hands-on to solve critical problems.

You will define and communicate a clear company-wide security strategy, align leaders around it, and drive remediation decisions with engineering, IT,