Head of Product Security

The role

Lead Zopa's Product Security function and own its multi-year strategy and operating model. Stay close to the team's technical work and advise the CISO and executive stakeholders.

What you will do

• Own and deliver the multi-year Product Security strategy, investment roadmap and priorities.
• Stay close to the team's day-to-day work and give hands-on technical guidance on complex security challenges.
• Define the Product Security operating model, including team structure, capacity planning, senior hiring and succession.
• Lead, grow and develop a high-performing Product Security function.
• Own Product Security risk appetite, control effectiveness, executive KPIs and regulatory and audit assurance.
• Act as a senior Product Security adviser to the CISO and executive Engineering, Product and Risk stakeholders.
• Set Product Security standards and drive their adoption across multiple engineering domains.
• Embed Secure by Design principles into engineering and software delivery.
• Prioritise investment and engineering effort according to security risk and business impact.
• Use AI, automation and modern security platforms to reduce manual effort and improve security workflows.

Required qualifications

• Proven track record of defining and delivering Product Security strategy across a complex engineering organisation.
• Significant experience leading and scaling a Product or Application Security function.
• A hands-on leader who understands the technical detail and can provide guidance when needed.
• Deep technical knowledge of modern Application Security, Secure SDLC, DevSecOps and cloud security.
• Experience operating in a complex, regulated technology business.
• Strong people leadership, with experience designing teams, hiring senior talent and developing capability.
• Experience owning and communicating Product Security risk, controls and executive-level metrics.
• Able to influence senior Engineering, Product, Risk and Security leaders.
• Proven ability to lead change and drive adoption across engineering teams you don't directly manage.
• Able to demonstrate measurable improvements in security and engineering outcomes.
• Pragmatic, forward-thinking and comfortable balancing security risk with business and customer outcomes.

Nice to have

• Experience with Wiz, Orca, Prisma Cloud, Microsoft Defender for Cloud, GitHub Advanced Security or equivalent platforms.
• Experience automating security processes, using AI to assist with vulnerability triage and remediation, and developing LLM-enabled security tooling.
• Experience reducing manual patching and repetitive security work through automation.

Benefits

• Flexible ways of working, with face-to-face collaboration and a good work-life balance valued.
• Option to work from abroad for up to 120 days a year, subject to right to work.
• Support to thrive in work and home life from day one.

Before you apply

• Working from abroad requires the right to work in the country of choice.
• Reasonable adjustments are available in the hiring process on request.
• Behavioural and competency-based interview stages: AI use is not permitted.
• Technical interview stages: AI use depends on the stage; the Talent Partner will say what is expected.

About the company

Zopa started in 2005 as a peer-to-peer lending company and launched Zopa Bank in 2020. It describes itself as a bank that aims to do the opposite of what customers dislike about finance.