Head of Information Security

The Information Security team at Zalando Payments acts as the second line of defense, owning the Information Security Management System and providing independent oversight of security risks and controls. As a regulated payments institution, we operate under frameworks such as DORA, PCI DSS, GDPR, and BaFin expectations, ensuring security is embedded, measurable, and auditable. As Head of Information Security, you will lead the team, own the information security strategy, and translate regulatory requirements and business priorities into a clear roadmap. Reporting directly to a Managing Director, you will advise senior management on security risks, control effectiveness, and investment priorities, providing independent challenges and clear recommendations.

• Lead and develop the Information Security team, setting clear priorities and owning the information security strategy, roadmap, and resource planning.
• Own and evolve the Information Security Management System, policies, and guidelines, ensuring alignment with DORA, PCI DSS, ISO 27001, and applicable regulatory expectations.
• Drive the ZPS Security Controls Framework, including independent assessment of control design and effectiveness, evidence requirements, and oversight of remediation.
• Identify, assess, and challenge information security risks, working with accountable owners to define treatment plans and escalate overdue actions or risks requiring management decisions.
• Provide independent oversight of security across cloud, infrastructure, applications, identity and access management, and shared ICT services delivered by Zalando Group and external providers.
• Advise Managing Directors and senior stakeholders through clear reporting on security exposure, control effectiveness, audit findings, and progress against the security roadmap.
• Coordinate information security contributions to internal and external audits, regulatory requests, PCI DSS assessments, and ISO 27001 readiness, overseeing the resolution of findings.
• Oversee the security aspects of incident management and contribute to DORA incident assessment, reporting, and lessons learned, in collaboration with operational teams and relevant control functions.
• Advance automated evidence collection and continuous control monitoring, strengthen security awareness and management training, and ensure security risks are considered in business and technology changes, including AI adoption.

• You bring at least 8 years of experience in Information Security, including leadership responsibility and ownership of an information security programme, ideally within payments, financial services, or another regulated environment.
• You have practical experience operating as a second line of defense, balancing independent oversight and constructive challenge with effective collaboration.
• You understand DORA, ISO 27001, PCI DSS, and relevant privacy and supervisory expectations, and can translate requirements into proportionate policies, controls, and assurance activities.
• You have owned or developed an Information Security Management System and led security risk assessments, control assurance, audits, and remediation oversight.
• You bring sufficient technical depth to assess and challenge security practices across cloud platforms, application security, vulnerability management, identity and access management, and incident response.
• You have experience overseeing outsourced or shared security services, establishing clear responsibilities, assessing service effectiveness, and escalating gaps.
• You can build and develop a team, prioritise competing demands, and communicate security risks and recommendations clearly to engineers, senior management, and business stakeholders.
• You bring a practical approach to automation, measurable control effectiveness, and continuous improvement. Relevant qualifications such as CISSP, CISM, or ISO 27001 Lead Implementer or Lead Auditor are welcome.