Head of Information Security (All Genders)

Role The Information Security team at Zalando Payments acts as the second line of defense, owning the Information Security Management System and providing independent oversight of security risks and controls. As a regulated payments institution, we operate under frameworks such as DORA, PCI DSS, GDPR, and BaFin expectations, ensuring security is embedded, measurable, and auditable. As Head of Information Security, you will lead the team, own the information security strategy, and translate regulatory requirements and business priorities into a clear roadmap. Reporting directly to a Managing Director, you will advise senior management on security risks, control effectiveness, and investment priorities, providing independent challenges and clear recommendations. You will work closely with Engineering, Operational Security, ICT Risk, Compliance, Legal, and other stakeholders across Zalando Payments and Zalando Group. Your scope includes oversight of security services provided by Group functions and external providers, while maintaining clear accountability between operational delivery and independent assurance. You will continue developing a scalable governance model through automated evidence collection, continuous control monitoring, and reporting that supports decisions. You will also drive regulatory readiness, security awareness, and the ongoing development of the Information Security Management System towards ISO 27001 certification. Responsibilities - Lead and develop the Information Security team, setting clear priorities and owning the information security strategy, roadmap, and resource planning. - Own and evolve the Information Security Management System, policies, and guidelines, ensuring alignment with DORA, PCI DSS, ISO 27001, and applicable regulatory expectations. - Drive the ZPS Security Controls Framework, including independent assessment of control design and effectiveness, evidence requirements, and oversight of remediation. - Identify, assess, and challenge information security risks, working with accountable owners to define treatment plans and escalate overdue actions or risks requiring management decisions. - Provide independent oversight of security across cloud, infrastructure, applications, identity and access management, and shared ICT services delivered by Zalando Group and external providers. - Advise Managing Directors and senior stakeholders through clear reporting on security exposure, control effectiveness, audit findings, and progress against the security roadmap. - Coordinate information security contributions to internal and external audits, regulatory requests, PCI DSS assessments, and ISO 27001 readiness, overseeing the resolution of findings. - Oversee the security aspects of incident management and contribute to DORA incident assessment, reporting, and lessons learned, in collaboration with operational teams and relevant control functions. - Advance automated evidence collection and continuous control monitoring, strengthen security awareness and management training, and ensure security risks are considered in business and technology changes, including AI adoption. Qualifications - At least 8 years of experience in Information Security, including leadership responsibility and ownership of an information security programme, ideally within payments, financial services, or another regulated environment. - Practical experience operating as a second line of defense, balancing independent oversight and constructive challenge with effective collaboration. - Understanding of DORA, ISO 27001, PCI DSS, and relevant privacy and supervisory expectations, with the ability to translate requirements into proportionate policies, controls, and assurance activities. - Experience owning or developing an Information Security Management System and leading security risk assessments, control assurance, audits, and remediation oversight. - Sufficient technical depth to assess and challenge security practices across cloud platforms, application security, vulnerability management, identity and access management, and incident response. - Experience overseeing outsourced or shared security services, establishing clear responsibilities, assessing service effectiveness, and escalating gaps. - Ability to build and develop a team, prioritise competing demands, and communicate security risks and recommendations clearly to engineers, senior management, and business stakeholders. - A practical approach to automation, measurable control effectiveness, and continuous improvement. Relevant qualifications such as CISSP, CISM, or ISO 27001 Lead Implementer or Lead Auditor are welcome. What We Offer Zalando provides a range of benefits, here’s an overview of what you can expect. Ask your Talent Acquisition Partner to learn more about what we offer. - 27 days of holiday a year to start for full-time employees (+1 day for every calendar year up to 30 days) - 40% off fashion and beauty products sold and shipped by Zalando, 30% off Lounge by Zalando, discounts from external partners - Family support, including counselling and dedicated services for parents and carers - Company pension scheme - Employee shares programme - Health and wellbeing options, including Wellhub - Mental health support and coaching - Development through our training platform and biannual peer-to-peer review - 2 paid volunteering days a year - Relocation assistance (subject to prior agreement)