← All roles

Head of InfoSec and IT Ops

Zip· Engineering
Apply on company site
Hybrid (San Francisco)Full-timePosted 2mo ago

About the role

Lead the enterprise security and IT operations program at Zip, building and guiding a scalable, engineering-oriented security and IT function to support a rapidly growing enterprise SaaS platform.

Responsibilities

  • Own the enterprise security program. Establish strategy, risk appetite, policies, control framework, roadmap, metrics, executive reporting, and decision rights.
  • Clarify and operate the product/corporate boundary. Partner with Product Security to define ownership across application security, cloud/production security, identity engineering, vulnerability management, detection/response, customer trust, and remediation.
  • Lead IT Operations and Engineering. Build a global service model across support, identity, endpoint, SaaS, collaboration, office/network, automation, asset lifecycle, and resilience; separate frontline support from systems engineering and drive secure self-service.
  • Build detection and response. Define priority threats and crown jewels, improve telemetry and detection coverage, establish 24/7 response, run incidents and exercises, ensure corrective actions prevent recurrence.
  • Own GRC, assurance, and customer trust. Maintain SOC 1/2, ISO 27001, and IS 42001 processes, prepare for SOX/public-company controls, manage audits and findings, enable fast customer security responses.
  • Secure AI and internal tools. Define risk tolerance, framework, and infrastructure to securely deploy AI and business apps built in-house.
  • Drive EIAM and data protection. Mature joiner/mover/leaver, privileged access, service identities, access reviews, data classification, DLP, encryption/key management, retention/deletion, and data controls.
  • Manage third-party and resilience risk. Mature TPRM by vendor risk tiering, establish controls, define service criticality/RTO/RPO, maintain crisis readiness.
  • Build the team and culture. Assess roles, hire selectively, develop leaders, create security/IT champions, and make safe pathways easy.

Qualifications

  • 12+ years across information security, security engineering, IT engineering/operations, risk, or related disciplines
  • 5+ years leading teams in a high-growth B2B SaaS company
  • Experience owning a broad enterprise security program and partnering with Product/Engineering
  • Demonstrated leadership of incidents, detection/response, vulnerability management, identity, endpoint/SaaS, cloud and secure SDLC programs
  • Practical experience with SOC 1/2, ISO 27001, privacy obligations, customer assurance, and audit remediation; SOX/public-company and ISO 42001 experience valuable
  • Strong technical judgment to review architecture and challenge IAM/cloud decisions
  • History of scaling IT service delivery through automation, self-service, clear SLOs, excellent employee experience
  • Ability to create clear decision rights in a federated environment and influence executives and engineers
  • Excellent written and incident communication; calm under pressure; high integrity and discretion
  • AI-forward and hands-on understanding of LLM/agent risks, data leakage, governance

Skills

Required:Enterprise security program managementProduct security collaborationIncident response and crisis managementGRC and audits (SOC 1/2, ISO 27001, IS 42001)IT service delivery & automationVendor risk management
Nice to have:AI & data security governance

Benefits

  • Not specified in the description
Last updated Aug 19, 2026. Interested? Apply on the company site.
Zip logo

About Zip

The future of B2B spend

b2bprocurement
Company profileWebsite

More open roles at Zip