Director of Cybersecurity

Zocalo; San Francisco (CA); On-site; USD 180,000 - 260,000; Full time

Job summary

Zocalo in San Francisco is seeking an experienced cybersecurity leader to oversee its enterprise information security program. This role blends strategy, hands-on oversight, risk management, and executive engagement to protect critical assets.

The ideal candidate has a strong technical foundation, experience with regulated environments, and a proven ability to balance business goals with evolving cybersecurity threats. You will mentor teams and report to senior leadership.

Qualifications

• 6+ years of progressive cybersecurity or information security experience.
• Experience leading security initiatives in regulated environments.
• Strong knowledge of security operations and risk management.
• Familiarity with NIST and financial services regulatory requirements.
• Experience supporting audits and enterprise risk assessments.
• CISSP, CISM, CRISC or comparable certifications preferred.

Responsibilities

• Lead enterprise cybersecurity strategy, security operations, and risk management.
• Oversee threat detection, incident response, vulnerability management, and security architecture.
• Lead cloud security, network protection, IAM, endpoint security, and data protection.
• Establish policies, controls, and governance aligned with standards.
• Advise on AI adoption, emerging tech, and third-party platforms.
• Partner with executives, compliance, and audit to mitigate risks.
• Mentor information security professionals.
• Present risks and performance to senior leadership.

Skills

Security leadership

Executive communication

Risk management

Cloud security

Incident response

Threat detection

Education

Bachelor's degree in CS/IT

Tools

SIEM

EDR/XDR

IAM

DLP

Cloud security tools

Job description

The Opportunity

We're partnering with an established financial services organization seeking an experienced cybersecurity leader to oversee its enterprise information security program.

This is a highly visible leadership opportunity combining cybersecurity strategy, hands-on technical oversight, risk management, and executive engagement.

The ideal candidate brings a strong technical foundation, experience leading security initiatives in a regulated environment, and the ability to balance business objectives with evolving cybersecurity threats.

Key Responsibilities

• Lead and continuously improve the organization's enterprise cybersecurity strategy, security operations, and risk management programs.
• Oversee threat detection, incident response, vulnerability management, and security architecture.
• Provide leadership across cloud security, network protection, identity management, endpoint security, and data protection.
• Establish security policies, controls, and governance practices aligned with industry standards and regulatory expectations.
• Guide security considerations surrounding AI adoption, emerging technologies, and third-party platforms.
• Partner with executive leadership, technology teams, compliance, and audit stakeholders to identify and mitigate security risks.
• Lead, mentor, and develop information security professionals.
• Present cybersecurity risks, program performance, and strategic recommendations to senior leadership.

Qualifications

• Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or a related discipline.
• 6+ years of progressive cybersecurity or information security experience, including technical and leadership responsibilities.
• Strong knowledge of security operations, incident response, enterprise security architecture, and risk management.
• Experience with SIEM, EDR/XDR, IAM, DLP, cloud security, vulnerability management, and network security technologies.
• Familiarity with cybersecurity frameworks such as NIST and financial services regulatory requirements.
• Experience supporting security audits, compliance initiatives, and enterprise risk assessments.
• Strong communication skills and demonstrated ability to advise executive stakeholders.
• CISSP, CISM, CRISC, or comparable certifications preferred.