Zip is recruiting a Head of InfoSec and IT Ops to join the team in California. It is a hybrid full-time role, so plan on splitting your week between home and the office. Zip has not published a salary for this role, so it is worth asking about pay early in the process.
The description below comes from Zip's own job posting.
Zip is the AI platform for enterprise procurement - built for humans and agents working together. By orchestrating procurement across teams, tools, and suppliers with the help of AI agents, companies can secure the resources they need to innovate faster than ever before.
The worldβs most influential enterprises trust Zip, including T-Mobile, OpenAI, AMD, Mars, Dollar Tree, and more. Together theyβve saved over $8 billion and processed over $500 billion in spend. Zipβs team includes product leaders from Apple, Airbnb, and Meta, as well as former procurement leaders from United Health, Sanofi, MGM Resorts, Discover, and NASA.
Backed by Adams Street, Alkeon, BOND, CRV, DST, Tiger Global, and Y Combinator, Zip has raised $371 million, most recently at a $2.2 billion valuation and has been recognized by Forbes Fintech 50, Fast Company's Most Innovative Companies, Inc. Best in Business, and LinkedIn Top Startups.
You will build and lead the enterprise security and IT operations system for Zip at a pivotal stage of scale. Zip operates a mission-critical enterprise SaaS platform, is rapidly expanding operations globally, and is building the governance and controls required for its next phase.
You will own a practical, engineering-oriented program spanning enterprise security governance, corporate security, detection and incident response, compliance and customer trust, and reliable employee technology. You will partner closely with Product and Engineering leaders responsible for the platform, and with Business Technology and Internal AI leaders building the systems and automations that run Zip.
Your first mandate is to make accountability unambiguous: understand the current program, agree boundaries with existing product/infrastructure security leadership, stabilize IT operations, and turn fragmented risks and services into one measurable operating model. You will lead by doing, while hiring and developing the team.
Own the enterprise security program. Establish strategy, risk appetite, policies, control framework, roadmap, metrics, executive reporting, and decision rights.
Clarify and operate the product/corporate boundary. Partner with Product Security to define who owns application security, cloud/production security, identity engineering, vulnerability management, detection/response, customer trust, and remediation.
Lead IT Operations and Engineering. Build a high-quality global service model across support, identity, endpoint, SaaS, collaboration, office/network, automation, asset lifecycle, and resilience. Separate frontline support from systems engineering and drive secure self-service.
Build detection and response. Define priority threats and crown jewels, improve telemetry and detection coverage, establish 24/7 response, run incidents and exercises, and ensure corrective actions prevent recurrence.
Own GRC, assurance, and customer trust. Maintain and streamline processes for SOC 1, SOC 2, ISO 27001, and IS 42001, prepare for future SOX/public-company controls, manage audits and findings, and enable fast, accurate customer security responses.
Secure AI and internal tools. Partner with internal teams to define the risk tolerance, framework, and infrastructure to securely deploy AI and business apps built in-house.
Drive EIAM and data protection. Mature joiner/mover/leaver, privileged access, service identities, access reviews, data classification, DLP, encryption/key management, retention/deletion, and sensitive-data controls.
Manage third-party and resilience risk. Mature TPRM by risk-tiering vendors, ensuring contractual and operational controls, defining service criticality/RTO/RPO, and maintaining crisis readiness.
Build the team and culture. Assess roles and capability gaps, hire selectively, develop leaders, create security/IT champions, and make the safe path the easy path.
12+ years across information security, security engineering, IT engineering/operations, risk, or related disciplines, including 5+ years leading teams in a high-growth B2B SaaS company.
Experience owning a broad enterprise security program and partnering deeply with Product/Engineering; credible across both corporate and product risk.
Demonstrated leadership of major incidents, detection/response, vulnerability management, identity, endpoint/SaaS, cloud and secure SDLC programs.
Practical experience with SOC 1/2, ISO 27001, privacy obligations, customer assurance, and audit remediation. SOX/public-company and ISO 42001 experience are valuable.
Strong technical judgment: can review architecture, challenge IAM and cloud decisions, understand application/data flows, and distinguish control evidence from real risk reduction.
History of scaling IT service delivery and systems engineering through automation, self-service, clear SLOs, and excellent employee experience.
Ability to create clear decision rights in a federated environment and influence executives and engineering leaders without relying on hierarchy.
Excellent written and incident communication; calm under pressure; high integrity and discretion.
AI-forward and hands-on: understands LLM/agent risks, MCP/tool access, prompt injection, data leakage, excessive agency, evaluations, and governance.
Experience at a procurement, fintech/payments, enterprise workflow, or data-sensitive SaaS company.
CISSP/CISM, cloud security, incident response, ISO lead implementer/auditor, or similar evidence of depth-certifications are not substitutes for outcomes.
Experience building an internal audit/SOX readiness program or operating through an IPO.
Experience integrating or consolidating security and IT organizations after leadership change.
Zip has not included pay in the posting.
It is hybrid. You would work partly from home and partly from the office in California.
The posting mentions skills such as SaaS. Read the full description above for the complete list.
Use the apply button on this page. It takes you to Zip's own application form, so your CV goes directly to their hiring team.
Zip published the role on August 18, 2026. We check the employer's job board every day and take this page down when the role closes, so if you can read it, the job was still listed at our last check.
Source: Zip careers page (jobs.ashbyhq.com). Applications go straight to the employer. We check the listing daily and remove it once it closes.
Zip publishes its open roles on its own careers board. This page collects the Zip jobs that are live right now. Each listing links to Zip's application form, and we remove a listing once the employer closes it.
Industry: Technology
View Company Profile β