[Hiring] Head of Information Security @OpenZeppelin

Role Description

You will own the strategy, design, and continuous maturation of OpenZeppelin's Information Security Program, and be accountable for managing the team executing it. You can issue-spot security and privacy risks before they materialize, explain the principles behind security and compliance controls to auditors and enterprise security teams, and calibrate our security program proportionate to risk.

• Strategy, governance and budget:
  • Set the strategic direction, multi-year roadmap, and risk posture of the Information Security Program.
  • Deliver on department OKRs.
  • Own the IT and technology budget, with ultimate responsibility for technology procurement.
• AI security and governance:
  • Own the secure adoption of AI across the company.
  • Evolve our AI governance framework.
  • Review and approve AI tools and agentic workflows.
  • Secure our agentic infrastructure (identity, least-privilege tool and data access, secrets handling, monitoring, auditability).
  • Manage frontier model providers as critical vendors.
  • Meet emerging obligations such as the EU AI Act.
• Compliance, audit and enterprise trust:
  • Own our audit, certification, and attestation strategy and execution.
  • Run a third-party and vendor risk management program.
  • Serve as the external face of our security program with customer security teams, regulated financial institutions, and auditors.
• Privacy and data governance:
  • Maintain a comprehensive data map of how data flows into, through, and out of the organization.
  • Own privacy compliance in partnership with Legal.
• Security operations and incident response:
  • Own the incident response program end-to-end.
  • Manage our bug bounty programs.
  • Partner with development teams to embed security best practices in the SDLC and our software offerings.
• IT and infrastructure:
  • Oversee identity and access management, provisioning and onboarding/offboarding, end-user security, physical security, disaster recovery, business continuity, and data backup.
  • Use automation and AI-powered workflows to make IT and security operations scale faster than headcount.

Qualifications

• 10+ years of Security and IT experience, including 3+ years leading a IT Security and GRC function in a high-growth tech company.
• A demonstrated trajectory toward CISO: you have owned a security program end-to-end, presented to executives or boards.
• Experience securing or governing AI/LLM-enabled products or enterprise AI adoption.

Requirements

• Ability to apply privacy and data-protection laws and practices (e.g., GDPR, CCPA/CPRA) in the AI context.

Nice to have

• 5+ years working in blockchain or a FinTech with an enterprise client base.

Logistics

• Our interview process takes place on Google Meet or Zoom and tends to consist of the following stages:
  • Recruiter Call (30 minutes)
  • Hiring Manager Call (30 minutes)
  • Team Interview (30 minutes)
  • Leadership Interview (30 minutes)
  • Paid work test (up to 20 hours of paid work)
  • Reference checks

Benefits

• Meet your teammates at company gatherings around the world 😎
• Enjoy the flexibility of fully remote work 🌎
• Take the time you need with flexible time off 🏝
• Grow your family with 8 weeks of paid leave for primary caregivers, 4 weeks for secondary caregivers, and a one-time $3,600 baby bonus 💙
• Build your ideal home office with up to $500 in equipment support 🪑
• Stay covered with medical insurance 🏥
• Keep growing with learning and development opportunities 🧠
• Get a monthly stipend for your preferred co-working space 💻