Head of Infosec

Zipline operates autonomous delivery systems that combine cloud services, customer and operational data, embedded software, aircraft, and field infrastructure. Security must protect those systems and the people who rely on them while enabling engineering teams to keep delivering.

As Head of Information Security, you will begin as a hands-on leader of a small team, working directly on Zipline’s most consequential security challenges. You will set the company-wide security strategy, turn it into an actionable roadmap, and grow the organization and capabilities needed to deliver it as Zipline scales. You and your team will design, build, and own critical security systems and pipelines while also setting standards and reviewing architecture across the company. You will partner with technical and business leaders to make security part of how Zipline designs and operates.

• Lead a small security team hands-on, taking direct ownership of priority security work while establishing Zipline’s information-security strategy, roadmap, operating model, and investment priorities across product, infrastructure, data, corporate technology, and cyber-physical systems.
• Scale the security engineering organization to deliver that roadmap, defining ownership boundaries with partner teams and recruiting, developing, and retaining the team needed to support Zipline’s growth and ambitions.
• Build a software security engineering function that designs, builds, and owns critical security systems and pipelines while also reviewing architectures proposed by other engineering teams.
• Partner with software, hardware, infrastructure, IT, legal, privacy, compliance, and operations leaders to embed security in system design and development workflows.
• Set architecture and engineering practices for identity, authentication, authorization, access control, secrets management, data protection, applications, cloud infrastructure, embedded software, aircraft, and field infrastructure.
• Direct threat modeling, secure development, vulnerability management, security testing, incident response, and security reviews; prioritize remediation based on Zipline’s most consequential risks.
• Report security posture through decision-useful measures, including risk coverage, security-review adoption, vulnerability remediation, and incident-response readiness, for executives, the board, and engineering leaders.

• Significant leadership experience in information security, product security, or software security engineering within a technically complex organization.
• Experience creating and executing a multi-year security roadmap while a company grows rapidly in scale and organizational complexity.
• A track record of leading a small security team hands-on, building a clear strategy and roadmap, and scaling the organization to deliver durable technical capabilities.
• Deep technical knowledge of software and infrastructure security, including identity, authentication, authorization, data protection, application security, and cloud security.
• Experience securing embedded software, hardware, robotics, aerospace, automotive, industrial systems, or another cyber-physical environment.
• Sound judgment balancing risk reduction, engineering velocity, and business needs; able to explain technical tradeoffs clearly to executives and engineers.
• Comfort moving between strategy and hands-on execution as priorities evolve, without adding unnecessary process or bureaucracy.

Zipline is an equal opportunity employer and prohibits discrimination and harassment of any type without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws or our own sensibilities.

We value diversity at Zipline and welcome applications from those who are traditionally underrepresented in tech. If you like the sound of this position but are not sure if you are the perfect fit, please apply!