THE ROLE & THE TEAM
The Information Security team at Zalando Payments acts as the second line of defense, owning the Information Security Management System and providing independent oversight of security risks and controls. As a regulated payments institution, we operate under frameworks such as DORA, PCI DSS, GDPR, and BaFin expectations, ensuring security is embedded, measurable, and auditable.
As Head of Information Security, you will lead the team, own the information security strategy, and translate regulatory requirements and business priorities into a clear roadmap. Reporting directly to a Managing Director, you will advise senior management on security risks, control effectiveness, and investment priorities, providing independent challenges and clear recommendations.
You will work closely with Engineering, Operational Security, ICT Risk, Compliance, Legal, and other stakeholders across Zalando Payments and Zalando Group. Your scope includes oversight of security services provided by Group functions and external providers, while maintaining clear accountability between operational delivery and independent assurance.
You will continue developing a scalable governance model through automated evidence collection, continuous control monitoring, and reporting that supports decisions. You will also drive regulatory readiness, security awareness, and the ongoing development of the Information Security Management System towards ISO 27001 certification.
WHAT WE’D LOVE YOU TO DO (AND LOVE DOING)
- Lead and develop the Information Security team, setting clear priorities and owning the information security strategy, roadmap, and resource planning.
- Own and evolve the Information Security Management System, policies, and guidelines, ensuring alignment with DORA, PCI DSS, ISO 27001, and applicable regulatory expectations.
- Drive the ZPS Security Controls Framework, including independent assessment of control design and effectiveness, evidence requirements, and oversight of remediation.
- Identify, assess, and challenge information security risks, working with accountable owners to define treatment plans and escalate overdue actions or risks requiring management decisions.
- Provide independent oversight of security across cloud, infrastructure, applications, identity and access management, and shared ICT services delivered by Zalando Group and external providers.
- Advise Managing Directors and senior stakeholders through clear reporting on security exposure, control effectiveness, audit findings, and progress against the security roadmap.
- Coordinate information security contributions to internal and external audits, regulatory requests, PCI DSS assessments, and ISO 27001 readiness, overseeing the resolution of findings.
- Oversee the security aspects of incident management and contribute to DORA incident assessment, reporting, and lessons learned, in collaboration with operational teams and relevant control functions.
- Advance automated evidence collection and continuous control monitoring, strengthen security awareness and management training, and ensure security risks are considered in business and technology changes, including AI adoption.
WE’D LOVE TO MEET YOU IF
- You bring at least 8 years of experience in Information Security, including leadership responsibility and ownership of an information security programme, ideally within payments, financial services, or another regulated environment.
- You have practical experience operating as a second line of defense, balancing independent oversight and constructive challenge with effective collaboration.
- You understand DORA, ISO 27001, PCI DSS, and relevant privacy and supervisory expectations, and can translate requirements into proportionate policies, controls, and assurance activities.
- You have owned or developed an Information Security Management System and led security risk assessments, control assurance, audits, and remediation oversight.
- You bring sufficient technical depth to assess and challenge security practices across cloud platforms, application security, vulnerability management, identity and access management, and incident response.
- You have experience overseeing outsourced or shared security services, establishing clear responsibilities, assessing service effectiveness, and escalating gaps.
- You can build and develop a team, prioritise competing demands, and communicate security risks and recommendations clearly to engineers, senior management, and business stakeholders.
- You bring a practical approach to automation, measurable control effectiveness, and continuous improvement. Relevant qualifications such as CISSP, CISM, or ISO 27001 Lead Implementer or Lead Auditor are welcome.
OUR OFFER
Zalando provides a range of benefits, here’s an overview of what you can expect. Ask your Talent Acquisition Partner to learn more about what we offer.
- 27 days of holiday a year to start for full-time employees (+1 day for every calendar year up to 30 days)
- 40% off fashion and beauty products sold and shipped by Zalando, 30% off Lounge by Zalando, discounts from external partners
- Family support, including counselling and dedicated services for parents and carers
- Company pension scheme
- Employee shares programme
- Health and wellbeing options, including Wellhub
- Mental health support and coaching
- Development through our training platform and biannual peer-to-peer review
- 2 paid volunteering days a year
- Relocation assistance (subject to prior agreement)
INCLUSIVE BY DESIGN
If you think you have what it takes, we encourage you to apply even if you don't meet every single requirement. You may just be the right candidate for this or other roles!
At Zalando, our vision is to be the leading European technology platform for fashion and lifestyle – one that thrives on diversity and is truly inclusive by design. We believe that diverse teams fuel innovation and creativity, and we actively seek out talent from all backgrounds.
We actively seek to reduce bias in our hiring and employment processes, focusing on your qualifications, skills, and contributions. To support this, we kindly ask that you refrain from including personal details such as your photo, age, or marital status in your CV, ensuring a fair and equitable evaluation based solely on your abilities and potential.
We are committed to providing an exceptional and accessible candidate experience for everyone. If you require any accommodations to support you throughout the hiring process, please let us know – we are here to assist you.
Discover more about our commitment to creating a diverse and inclusive workplace: https://jobs.zalando.com/en/our-culture/diversity-and-inclusion
