Head of Information Security in London

This is a step-up role. We're not looking for someone who has already done this job at a mature enterprise - we're looking for someone who is ready to own it now: hands-on, curious, and comfortable with the AI-native ways of working that define how Zinc operates. If you want to build something, not just inherit it, this is the role for you.

Requirements:

• 5+ years in information security, with at least 2 years in a leadership or senior practitioner role - SOC management, security architecture, penetration testing, or engineering.
• Ready to step up - you've been a senior practitioner and you're ready to own the function.
• AI literate - you understand the security implications of LLMs, AI tooling, agentic workflows, shadow AI, and third-party SaaS risk. This is not optional at Zinc.
• High EQ - you'll inherit an existing team member who is professional, capable, and ambitious. How you lead that relationship matters more than your CV.
• Strong communicator - you'll be speaking to auditors, customers, and a non-technical leadership team. You need to translate risk into language that drives decisions.
• Compliance-aware, not compliance-driven - you understand the standards but you lead with risk, not box-ticking.
• Comfortable with ambiguity - the playbook is incomplete. You'll write it.
• (Desirable) Experience in a fast-growing global SaaS business.
• (Desirable) Familiarity with DevSecOps and secure development lifecycle practices.
• (Desirable) Relevant certifications (CISSP, CISM, or similar).
• (Desirable) Experience with cloud security (AWS, Azure, or GCP).

What the job involves:

• Zinc has grown to 150+ people, we're scaling fast, and our information security function needs to grow with us. We need to continue maturing our InfoSec function in line with our rate of growth.
• We're hiring a Head of Information Security - the person who will own this function, define what good looks like at Zinc's scale, and build the credibility internally and externally that our customers, partners, and regulators expect.
• You’ll report into our General Counsel and work closely with our AI & Automation lead, operating in an environment where security is understood as a business enabler, not a blocker.
• Establishing security maturity - your first 90 days are about understanding what good looks like at our stage and mapping the path to get there.
• AI security governance - you'll be in the room with our COO and AI lead regarding adoption decisions from day one.
• Incident management ownership - you're the lead on any material incident. Set up the playbooks, own the response.
• Building the function - you'll have one direct report, our InfoSec Manager. Your job is to define what this function needs to look like in 2-3 years, and start executing.
• Information security strategy - defining and owning the multi-year roadmap.
• Security architecture - reviewing and advising on technical design decisions, embedding security by design across products and platforms.
• Risk management - maintaining the risk register, identifying, prioritising, and tracking the things that actually matter.
• Compliance programmes - ISO 27001, SOC 2, and relevant sector standards; in close partnership with our Compliance team.
• Incident management - owning major incident response; first port of call in a crisis.
• Customer and supplier security - security questionnaires, diligence requests, contractual requirements.
• Third-party risk - vendor security assessment and ongoing monitoring.
• Security awareness - training, culture, getting the business to care.
• Budget - managing the InfoSec budget and investment cases, aligned to Zinc's risk profile.