Head of InfoSec and IT Ops

ZipHQ, Inc.; San Francisco (CA); Híbrido; USD 250 000 - 350 000; Tempo integral

Resumo da oferta

ZipHQ, Inc. is seeking an experienced security and IT operations leader to scale enterprise security for a rapidly growing, global SaaS platform.

You will establish governance, risk, and controls across product and infrastructure teams, and partner with AI and internal tooling groups to secure deployments. You will drive 24/7 detection/response, audits (SOC 1/2, ISO 27001), and future SOX readiness while building a high-performing security and IT organization.

Qualificações

• 12+ years in information security, security engineering, or IT operations in a high-growth B2B SaaS environment.
• Proven leadership of enterprise security programs and collaboration with product/engineering teams.
• Experience leading incidents, detection/response, vulnerability management, identity, and cloud security programs.
• Familiarity with audit readiness, privacy obligations, and customer assurance.
• Hands-on AI security awareness including LLM risks and governance.

Responsabilidades

• Own the enterprise security program: strategy, policies, control framework, roadmap, metrics, executive reporting, and decision rights.
• Define product/corporate boundary with Product Security and own application security, cloud security, identity, and threat remediation.
• Lead IT Operations and Engineering: global service model, automation, self-service, and resilience.
• Build detection and response: threat prioritization, telemetry, 24/7 incident response, and post-incident follow-up.
• Own GRC, assurance, and customer trust: SOC 1/2, ISO 27001, privacy, audits, and customer security responses.
• Secure AI and internal tools: risk tolerance, framework, and infrastructure for AI deployments.
• Drive EIAM and data protection: joiner/mover/leaver, privileged access, data classification, encryption, retention.
• Manage third-party and resilience risk: TPRM, vendor risk tiers, RTO/RPO, crisis readiness.
• Build the team and culture: hire and develop security leaders, establish security champions, make safe paths easy.

Conhecimentos

Enterprise security leadership

Incident response management

Risk governance

AI security governance

Stakeholder collaboration

Ferramentas

SOC 1/2

ISO 27001

SOX readiness

Descrição da oferta de emprego

About Zip

Zip is the AI platform for enterprise procurement — built for humans and agents working together. By orchestrating procurement across teams, tools, and suppliers with the help of AI agents, companies can secure the resources they need to innovate faster than ever before.
The world’s most influential enterprises trust Zip, including T-Mobile, OpenAI, AMD, Mars, Dollar Tree, and more. Together they’ve saved over $8 billion and processed over $500 billion in spend. Zip’s team includes product leaders from Apple, Airbnb, and Meta, as well as former procurement leaders from United Health, Sanofi, MGM Resorts, Discover, and NASA.
Backed by Adams Street, Alkeon, BOND, CRV, DST, Tiger Global, and Y Combinator, Zip has raised $371 million, most recently at a $2.2 billion valuation and has been recognized by Forbes Fintech 50, Fast Company's Most Innovative Companies, Inc. Best in Business, and LinkedIn Top Startups.

Your Role

You will build and lead the enterprise security and IT operations system for Zip at a pivotal stage of scale. Zip operates a mission-critical enterprise SaaS platform, is rapidly expanding operations globally, and is building the governance and controls required for its next phase.

You will own a practical, engineering-oriented program spanning enterprise security governance, corporate security, detection and incident response, compliance and customer trust, and reliable employee technology. You will partner closely with Product and Engineering leaders responsible for the platform, and with Business Technology and Internal AI leaders building the systems and automations that run Zip.

Your first mandate is to make accountability unambiguous: understand the current program, agree boundaries with existing product/infrastructure security leadership, stabilize IT operations, and turn fragmented risks and services into one measurable operating model. You will lead by doing, while hiring and developing the team.

What you'll do

• Own the enterprise security program. Establish strategy, risk appetite, policies, control framework, roadmap, metrics, executive reporting, and decision rights.

• Clarify and operate the product/corporate boundary. Partner with Product Security to define who owns application security, cloud/production security, identity engineering, vulnerability management, detection/response, customer trust, and remediation.

• Lead IT Operations and Engineering. Build a high-quality global service model across support, identity, endpoint, SaaS, collaboration, office/network, automation, asset lifecycle, and resilience. Separate frontline support from systems engineering and drive secure self-service.

• Build detection and response. Define priority threats and crown jewels, improve telemetry and detection coverage, establish 24/7 response, run incidents and exercises, and ensure corrective actions prevent recurrence.

• Own GRC, assurance, and customer trust. Maintain and streamline processes for SOC 1, SOC 2, ISO 27001, and IS 42001, prepare for future SOX/public-company controls, manage audits and findings, and enable fast, accurate customer security responses.

• Secure AI and internal tools. Partner with internal teams to define the risk tolerance, framework, and infrastructure to securely deploy AI and business apps built in-house.

• Drive EIAM and data protection. Mature joiner/mover/leaver, privileged access, service identities, access reviews, data classification, DLP, encryption/key management, retention/deletion, and sensitive-data controls.

• Manage third-party and resilience risk. Mature TPRM by risk-tiering vendors, ensuring contractual and operational controls, defining service criticality/RTO/RPO, and maintaining crisis readiness.

• Build the team and culture. Assess roles and capability gaps, hire selectively, develop leaders, create security/IT champions, and make the safe path the easy path.

What we're looking for

• 12+ years across information security, security engineering, IT engineering/operations, risk, or related disciplines, including 5+ years leading teams in a high-growth B2B SaaS company.

• Experience owning a broad enterprise security program and partnering deeply with Product/Engineering; credible across both corporate and product risk.

• Demonstrated leadership of major incidents, detection/response, vulnerability management, identity, endpoint/SaaS, cloud and secure SDLC programs.

• Practical experience with SOC 1/2, ISO 27001, privacy obligations, customer assurance, and audit remediation. SOX/public-company and ISO 42001 experience are valuable.

• Strong technical judgment: can review architecture, challenge IAM and cloud decisions, understand application/data flows, and distinguish control evidence from real risk reduction.

• History of scaling IT service delivery and systems engineering through automation, self-service, clear SLOs, and excellent employee experience.

• Ability to create clear decision rights in a federated environment and influence executives and engineering leaders without relying on hierarchy.

• Excellent written and incident communication; calm under pressure; high integrity and discretion.

• AI-forward and hands-on: understands LLM/agent risks, MCP/tool access, prompt injection, data leakage, excessive agency, evaluations, and governance.

Nice to have

• Experience at a procurement, fintech/payments, enterprise workflow, or data-sensitive SaaS company.

• CISSP/CISM, cloud security, incident response, ISO lead implementer/auditor, or similar evidence of depth—certifications are not substitutes for outcomes.

• Experience building an internal audit/SOX readiness program or operating through an IPO.

• Experience integrating or consolidating security and IT organizations after leadership change.