[Hiring] Head of IT & Security @OpenZeppelin

Role Description

You will own the strategy, design, and continuous maturation of OpenZeppelin's Information Security Program, and be accountable for managing the team executing it. You can issue-spot security and privacy risks before they materialize, explain the principles behind security and compliance controls to auditors and enterprise security teams, and calibrate our security program proportionate to risk.

• IT and infrastructure:
  • Oversee identity and access management, provisioning and onboarding/offboarding, end-user security (MDM, endpoint protection, security training), physical security, disaster recovery, business continuity, and data backup.
  • Utilize automation and AI-powered workflows to scale IT and security operations faster than headcount.
• Strategy, governance and budget:
  • Set the strategic direction, multi-year roadmap, and risk posture of the Information Security Program.
  • Deliver on department OKRs and own the IT and technology budget, with ultimate responsibility for technology procurement.
• AI security and governance:
  • Own the secure adoption of AI across the company, evolving our AI governance framework.
  • Review and approve AI tools and agentic workflows, securing our agentic infrastructure.
  • Manage frontier model providers as critical vendors, covering security and data-handling diligence.
  • Meet emerging obligations such as the EU AI Act.
• Compliance, audit and enterprise trust:
  • Own our audit, certification, and attestation strategy and execution.
  • Run a third-party and vendor risk management program.
  • Serve as the external face of our security program with customer security teams, regulated financial institutions, and auditors.
• Privacy and data governance:
  • Maintain a comprehensive data map of how data flows into, through, and out of the organization.
  • Own privacy compliance in partnership with Legal: GDPR, CCPA/CPRA, DPAs and contractual security commitments.
• Security operations and incident response:
  • Own the incident response program end-to-end, including playbooks, tabletop exercises, and post-incident reviews.
  • Manage our bug bounty programs and partner with development teams to embed security best practices in the SDLC.

Qualifications

• 10+ years of Security and IT experience, including 3+ years leading an IT Security and GRC function in a high-growth tech company.
• A demonstrated trajectory toward CISO: ownership of a security program end-to-end and experience presenting to executives or boards.
• Experience securing or governing AI/LLM-enabled products or enterprise AI adoption.

Requirements

• Ability to apply privacy and data-protection laws and practices (e.g., GDPR, CCPA/CPRA) in the AI context.

Nice to have

• 5+ years working in blockchain or a FinTech with an enterprise client base.

Logistics

• Our interview process takes place on Google Meet or Zoom and tends to consist of the following stages:
  • Recruiter Call (30 minutes)
  • Hiring Manager Call (30 minutes)
  • Team Interview (30 minutes)
  • Leadership Interview (30 minutes)
  • Paid work test (up to 20 hours of paid work)
  • Reference checks

Benefits

• Meet your teammates at company gatherings around the world.
• Enjoy the flexibility of fully remote work.
• Take the time you need with flexible time off.
• Grow your family with 8 weeks of paid leave for primary caregivers, 4 weeks for secondary caregivers, and a one-time $3,600 baby bonus.
• Build your ideal home office with up to $500 in equipment support.
• Stay covered with medical insurance.
• Keep growing with learning and development opportunities.
• Get a monthly stipend for your preferred co-working space.