Head of Information Security and IT Operations
About the job
- At least 12 years of experience across information security, security engineering, IT engineering or operations, risk, or related disciplines, including at least 5 years leading teams in a high-growth business-to-business software-as-a-service company.
- Experience owning a broad enterprise security program and partnering deeply with Product and Engineering across corporate and product risk.
- Demonstrated leadership of major incidents, detection and response, vulnerability management, identity, endpoint and software-as-a-service, cloud, and secure software development lifecycle programs.
- Practical experience with SOC 1, SOC 2, ISO 27001, privacy obligations, customer assurance, and audit remediation.
- Strong technical judgment, including reviewing architecture, challenging identity and access management and cloud decisions, understanding application and data flows, and distinguishing control evidence from actual risk reduction.
- Experience scaling IT service delivery and systems engineering through automation, self-service, clear service-level objectives, and employee experience improvements.
- Ability to create clear decision rights in a federated environment and influence executives and engineering leaders without relying on hierarchy.
- Strong written and incident communication, calmness under pressure, high integrity, and discretion.
- Understanding of large language model and agent risks, model context protocol and tool access, prompt injection, data leakage, excessive agency, evaluations, and governance.
- Own the enterprise security program by establishing strategy, risk appetite, policies, a control framework, roadmap, metrics, executive reporting, and decision rights.
- Define and operate the product and corporate security boundary with Product Security, including ownership of application security, cloud and production security, identity engineering, vulnerability management, detection and response, customer trust, and remediation.
- Lead IT Operations and Engineering by building a global service model across support, identity, endpoint, software-as-a-service, collaboration, office and network services, automation, asset lifecycle, and resilience.
- Build detection and response by defining priority threats and critical assets, improving telemetry and detection coverage, establishing 24/7 response, running incidents and exercises, and ensuring corrective actions prevent recurrence.
- Own governance, risk, and compliance, assurance, and customer trust processes for SOC 1, SOC 2, ISO 27001, and ISO 42001; prepare for future SOX and public-company controls, manage audits and findings, and support customer security responses.
- Partner with internal teams to define risk tolerance, frameworks, and infrastructure for securely deploying artificial intelligence and internally built business applications.
- Mature joiner, mover, and leaver processes, privileged access, service identities, access reviews, data classification, data loss prevention, encryption and key management, retention and deletion, and sensitive-data controls.
- Mature third-party risk management by risk-tiering vendors, ensuring contractual and operational controls, defining service criticality and recovery objectives, and maintaining crisis readiness.
- Assess roles and capability gaps, hire selectively, develop leaders, create security and IT champions, and make secure practices easier to follow.
- Experience at a procurement, fintech or payments, enterprise workflow, or data-sensitive software-as-a-service company.
- CISSP or CISM certification, cloud security, incident response, ISO lead implementer or auditor experience, or similar evidence of depth.
- Experience building an internal audit or SOX readiness program or operating through an initial public offering.
- Experience integrating or consolidating security and IT organizations after a leadership change.
About the company
Zip sells procurement software to businesses that lets employees request purchases while finance, legal, and security teams review them in one shared workflow. Its intake system gathers purchase details up front and routes each request through the approvals required by a company's policies. The platform connects requests to supplier onboarding, contracts, purchase orders, invoices, and payments, so teams track a purchase from initial need to settlement. AI agents review documents and handle repetitive tasks within those controls, while customers pay for software subscriptions and add-on capabilities. Zip was founded in 2020 and is headquartered in San Francisco, California.
Company Size
501-1,000
Company Stage
Series D
Total Funding
$371M
Headquarters
San Francisco, California
Founded
2020
Get referred to Zip
See people who can refer or advise you
Simplify's Take
What believers are saying
- New York roles gain scope: in July 2026, Zip opened its Chelsea hub and announced plans to double local staff.
- Embedded workflows prove value: Dollar Tree reports $125 million in supported renewal savings after co-designing purchasing processes with Zip.
- Zip expands its sales footprint: September 2026 brought a full supplier risk management solution inside purchasing workflows.
What critics are saying
- Incumbents attack Zip's core: in May 2026, Coupa launched agent orchestration backed by its $10 trillion spend dataset.
- Automation still demands delivery staff: Zip bundles custom agent engineering and AI consumption credits into its enterprise transformation offering.
- Expect extra effort: Zip's named underdog and ownership values explicitly ask staff for urgency, harder work, and extra effort.
What makes Zip unique
- Governance travels into AI chats: Zip MCP brings permissioned purchasing data directly into Claude, ChatGPT, and Gemini.
- Buyers guide implementation: Zip embeds former UnitedHealth and Sanofi procurement leaders in its Enterprise Transformation Office.
- Integration changes stay auditable: Zip owns App Studio, which records custom workflow changes in an exportable history.
Help us improve and share your feedback! Did you find this helpful?
Benefits
📈 Start-up equity
💸 401k plan
🦷 Full health, vision & dental coverage
🍽️ Catered lunches & dinners
🚍 Commuter benefit
🚠 Team building events & happy hours
🌴 Unlimited PTO
💻 Shiny new Apple equipment
🪑 Generous office stipend for remote employees
Growth & Insights and Company News
6 month growth
1%1 year growth
0%2 year growth
2%Zip has expanded its AI Risk Orchestration platform into a comprehensive third-party risk management solution. The company announced the development at its annual conference in New York, alongside new features including sourcing and purchase order management tools, an app marketplace, and accrual accounting automation. Since launching in April 2025, AI Risk Orchestration has delivered 85% faster cycle times, 98% portal completion rates, and doubled supplier risk coverage for customers including Mutual of Omaha, Stripe, Affirm, and Rivian. The platform has also reduced manual review work by up to 90%. The enhanced solution integrates vendor risk reviews directly into procurement workflows. It addresses challenges enterprises face managing multiple vendors, particularly AI providers handling sensitive data. "Risk management has traditionally lived beside procurement, even though the purchasing process is where companies decide which vendors they're willing to trust," said Rujul Zaparde, Zip's co-founder and CEO.
Zip and Hackett partner on procurement AI governance. Here's why the controls that make source-to-pay work are the ones AI agents most need. September 2nd, 2026 Brooks Rocco Content Lead at Zip Table of Contents In the past eighteen months, Zip has worked with The Hackett Group on dozens of implementations, making Hackett one of the most experienced delivery partners in its ecosystem. ZipHQ, Inc. is pleased to share that ZipHQ, Inc. is now expanding this partnership into a joint practice focused on governance for AI in procurement The operating model comes before the platform. Hackett has spent more than thirty years benchmarking SG&A functions, tracking about 50,000 metrics across finance, HR, IT, and procurement. Their work informs what world-class performance looks like in a given sector, with the consulting teams building the roadmap to get there. This is why their implementations tend to start with the operating model rather than the configuration. Hackett's teams redesign approval structures, redefine procurement business partner roles, and rebuild reporting around unified request data before anyone even touches the platform. Clients consolidating intake, purchasing, and invoice processing run one implementation where they'd previously scoped three. "The projects that go well are the ones where we settle the operating model before anyone configures anything. Zip holds those decisions once we've made them, which is why we keep bringing it to clients," said Nick Xiao, Principal, The Hackett Group What ZipHQ, Inc. is building next. The disciplines that make a source-to-pay transformation work are the same ones enterprise AI needs to run safely at scale: decision rights, controls, data ownership, role definitions, and escalation paths. Hackett has been installing those for thirty years, while today AI agent governance applies them to software that acts on its own. That's the next phase of the partnership. Zip's AI Superagents act on live procurement data inside the platform, and Hackett is building the governance model around them. ZipHQ, Inc. is working together to define the decisions an agent is trusted to without human review, the escalation thresholds that route a decision to a human-in-the-loop, the controls that keep an audit trail defensible to internal and external audit, and who is accountable when what an agent decides is wrong. Most procurement teams today are running AI pilots with governance yet undefined. Together, Zip and The Hackett Group are working to solve this. Earlier this year, The Hackett Group and Spend Matters named Zip in four Top Tech categories in the Spring 2026 SolutionMap, for intake and orchestration, procure-to-pay, e-procurement, and AP automation. If you're evaluating procurement platforms this year, contact Hackett's team to walk through what a Zip deployment looks like in the first 90 days, including the operating model decisions that build the foundation for your transformation. Brooks Rocco Content Lead at Zip Brooks Rocco is Content Lead at Zip, the world's leading procurement orchestration platform. With expertise in crafting data-driven strategies and a passion for elevating procurement, Brooks creates insightful, actionable content for finance and procurement leaders. When he's not shaping Zip's thought leadership, Brooks enjoys exploring innovative ways to connect brands with their audiences.
Zip has been named a Leader in the IDC MarketScape: Worldwide AI-Enabled Spend Orchestration 2026 Vendor Assessment for the second consecutive time. The report highlighted Zip as a "category-defining platform with the largest spend orchestration reference base" and praised its agentic AI capabilities and production deployments. The AI-powered procurement platform serves over 800 global enterprises, including Anthropic, AMD, Visa, and OpenAI. Zip has processed over $500 billion in spend and saved customers more than $10 billion through its AI suite. Earlier this month, Zip launched Superagents, described as the first fully governed and auditable AI agents in procurement. The company was also named a Visionary in the 2026 Gartner Magic Quadrant for Source-to-Pay Suites.
Zip, an AI-powered enterprise procurement platform, has opened a new office in New York City's Chelsea neighbourhood and plans to double its local team over the next year. The company, which counts Anthropic, OpenAI, and T-Mobile among its customers, is expanding to be closer to its growing East Coast client base. The new hub will house teams across sales, engineering, product, and other functions. Zip has processed over $500 billion in enterprise spending and helped customers save more than $10 billion through its AI platform. A recent Forrester study found the platform delivers 386% ROI for large enterprises. The NYC expansion comes ahead of Zip Forward, the company's procurement conference, scheduled for 16-17 September in New York.
Trump administration, OpenAI discussing possible government stake in the AI startup - CNBC. Business Software Startup Zip Is Valued at $2.2 Billion Bloombergsource How Damaging Are AI News Summaries to Publishers? Hollywood Reportersource Insight into the 13th WTO Ministerial Conference csis.orgsource