Head of Information Security

Zipline; San Francisco (CA); On-site; USD 250,000 - 400,000; Full time

Job summary

Zipline in San Francisco seeks a Head of Information Security to own company-wide information security and privacy strategy, leading a lean, technical team across applications, product, and corporate security.

You will prioritize the highest-consequence risks and work with Engineering, IT, Legal, Safety, and Operations to build scalable controls, threat modeling, incident response, and secure development practices enabling rapid, safe growth.

Qualifications

• Experience leading serious security incident response.
• Technical depth across application, infrastructure, cloud, identity, data, and hardware security.
• Software engineering foundation or production security experience.
• Judgment balancing security, privacy, legal obligations, safety, velocity, and business objectives.

Responsibilities

• Own Zipline's information security and privacy strategy and operating model.
• Lead a security engineering team and drive production security capabilities.
• Partner with Engineering, IT, Legal, Safety, Operations to prioritize and remediate risks.

Skills

Security strategy

Threat modeling

Incident response

Security engineering

Job description

• Zipline operates autonomous delivery systems spanning cloud services, customer and operational data, embedded software, aircraft, and field infrastructure
• Security must protect those systems, customers, partners, and the people who rely on them while enabling engineering teams to deliver safely and quickly
• As Head of Information Security, you will own company-wide information security and privacy strategy and lead a lean, technical organization across application, product and corporate security
• You will first focus the company on its most consequential risks and remediation decisions, then build the engineering capabilities, controls, and operating model that scale with Zipline
• You will define and communicate a clear company-wide security strategy, align leaders around it, and work hands-on with engineers to build and operate the security capabilities that address our highest-priority risks
• As Zipline continues to grow, you’ll have the opportunity to grow with it, taking on broader scope and organizational leadership as the company’s needs evolve
• Set security and privacy strategy, risk posture, roadmap, operating model, and investment priorities across product, infrastructure, data, corporate technology, and physical systems
• Identify and sequence the company’s highest-consequence risks, driving clear remediation decisions with Engineering, IT, Legal, Safety, Operations, and Physical Security
• Be a pragmatic problem solver who helps engineering teams move quickly and securely. Make tradeoffs clear, find practical ways to reduce risk, and build tools and processes that make secure development easy
• Communicate material security and privacy risk clearly to company leaders and partners, translating technical findings into business tradeoffs and investment decisions
• Lead a software security engineering team that owns security capabilities in production, contributes fixes and reusable platforms, and works alongside Engineering to eliminate systemic vulnerability classes
• Build and develop a high-performing team through hiring, coaching, clear expectations, and direct performance management
• Establish security architecture and practices for identity, access control, secrets, data protection, applications, cloud infrastructure, embedded software, aircraft, and field infrastructure
• Lead threat modeling, testing, vulnerability management, incident response, and security reviews; measure risk coverage, remediation, readiness, control effectiveness, and secure-engineering adoption

Experience leading serious security incident response and assessing threats from sophisticated external attackersTechnical depth across application, infrastructure, cloud, identity, data, and hardware securityA software engineering foundation, including experience building production software, security systems, or technical controlsExperience securing safety-critical or cyber-physical systems, such as embedded, robotics, aerospace, automotive, or industrial technologyJudgment balancing security, privacy, legal obligations, safety, engineering velocity, customer needs, and business objectives while working directly in a lean teamProven senior leadership experience in a highly technical, fast-paced organization, with experience operating at scale and leading security through rapid growth. Demonstrated experience owning security strategy and hands-on execution across information security, product security, or security engineering