Head of Security

SPAN | Renewable energy

2h 7m ago

On-site

Full Time

Lead

United States of America

Our Mission

SPAN is enabling electrification for all ⚡

We are a mission-driven company designing, building, and deploying products that electrify the built environment, reduce carbon emissions, and slow the effects of climate change.

Decarbonization is the process to reduce or remove greenhouse gas emissions, especially carbon dioxide, from entering our atmosphere.
Electrification is the process of replacing fossil fuel appliances that run on gas or oil with all-electric upgrades for a cleaner way to power our lives.

At SPAN, we believe in:

Enabling homes and vehicles powered by clean energy
Making electrification upgrades possible
Building more resilient homes with reliable backup
Designing a flexible and distributed electrical grid

The Role

As the Head of Security at SPAN, you will lead a high-performing security organization at the forefront of the clean energy transition. This is a critical executive leadership role responsible for the end-to-end security strategy across our entire ecosystem: spanning our smart electrical panels, embedded firmware, cloud infrastructure, mobile applications, and enterprise IT.

You will work closely with elite hardware and software engineers, driving technical excellence and embedding security into the DNA of how we build the future of home electrification. You will define the multi-year security roadmap, manage our total risk exposure, and ensure the safety, resilience, and privacy of our customers' energy data and critical home infrastructure.

Responsibilities:

Security Strategy & Executive Leadership: Define, own, and execute a comprehensive multi-year enterprise and product security roadmap. Translate business objectives, threat landscapes, and regulatory requirements into an actionable strategy. Present to executive leadership and the board on security posture, program maturity, and total risk exposure.
Product & IoT Security (Secure-by-Design): Partner with hardware, firmware, and platform engineering teams to embed security across the entire product development lifecycle. Oversee threat modeling, penetration testing, and security requirements for our hardware. Secure the Over-The-Air (OTA) update pipeline, cryptographic key management, and embedded system communications.
Cloud & Application Security: Champion a “security by design” culture for our cloud backend and customer-facing mobile applications. Integrate automated security tooling (SAST, DAST) into CI/CD pipelines and ensure the integrity of our cloud-to-device communication channels at scale.
AI & Machine Learning Security: Secure SPAN's expanding AI and machine learning infrastructure, serving as the security cornerstone for the development of our platform. Develop threat models for ML pipelines, ensure AI model integrity, protect against adversarial inputs, and establish robust data governance and privacy guardrails for AI workloads processing home energy telemetry.
Enterprise Security & Operations: Govern enterprise IT security and lead the transition toward a Zero Trust architecture. Oversee endpoint defense (EDR), identity and access management (IAM), and secure network architecture.
Vulnerability Management & Incident Response: Build and operate a world-class vulnerability management program and lead the Product Security Incident Response Team (PSIRT). Establish coordinated disclosure processes, manage bug bounty programs, coordinate third-party red team engagements, and ensure rapid triage and remediation.
Governance, Risk & Compliance (GRC): Define and author the enterprise security policy framework, ensuring alignment with global regulatory standards (e.g., SOC 2, ISO 27001, NIST) and relevant IoT/energy security standards. Oversee supply chain security, Software Bill of Materials (SBOM) practices, and third-party vendor risk.
Team Building & Mentorship: Recruit, mentor, and lead a diverse, high-performing team of security engineers, architects, and GRC specialists. Foster a culture of ownership, technical excellence, and collaboration across the global engineering organization.

About You:

Experience: 10+ years of progressive experience in cybersecurity, with at least 5 years in a security leadership role at a hardware, consumer electronics, IoT, or software-defined product company.
Technical Breadth & Depth: Deep technical expertise spanning cloud-native architectures (AWS/GCP), application security, and connected device/embedded security. You have a hands-on engineering background and the credibility to influence elite technical teams without relying solely on direct authority.
Builder Mindset: Demonstrated ability to build, scale, and up-level security programs. You are equally comfortable defining enterprise governance models as you are diving into a threat model for a new hardware feature.
Strategic Communicator: Proven track record of operating at the executive level—translating complex, deeply technical cyber risks into clear business terms for the C-suite, board members, and enterprise partners.
Compliance & Governance Expertise: Strong working knowledge of successfully steering organizations through complex compliance audits (SOC 2, ISO 27001) and implementing data governance and privacy frameworks.
Mission-Driven: A deep passion for SPAN’s mission to reinvent the electrical panel, decarbonize the residential sector, and accelerate the mass adoption of clean energy.
Education & Certifications: B.S. or M.S. in Computer Science, Computer Engineering, Cybersecurity, or equivalent practical experience. Industry-recognized leadership certifications (e.g., CISSP, CISM, CISA) are highly preferred.

Life at SPAN

Headquartered in San Francisco’s vibrant SoMa neighborhood, we are an eclectic group of creative thinkers who value open communication, teamwork, and a ‘make it happen’ approach to addressing complex challenges.

SPAN embraces diversity and equal opportunity in a serious way. We are committed to building a team that represents a variety of backgrounds, perspectives, and skills.

We’re hiring talented individuals who are driven by success and are passionate about shaping the future of renewable energy. If that sounds like you, we’d love for you to consider joining the rapidly growing team at SPAN.

The Perks:

⚡ Competitive compensation + equity grants at a well-funded, venture-backed company

⚡ Comprehensive benefits: 100% employee premiums for base plans on medical, dental, vision with options for additional coverage. Parental leave up to twenty four (24) weeks depending on eligibility

⚡ Comfortable, sunny office space located near BART and Caltrain public transit

⚡ Strong focus on team building and company culture: Employee Resource Groups, monthly social events, SPANcakes recognition breakfast, lunch, and learns

⚡ Flexible hours, one holiday per month, and flexible time off

Interested in joining our team? Apply today and we’ll be in touch with the next steps!

Required Skills

awsgcpsastdastiam

Required Languages

🇬🇧 English

The Role

Responsibilities:

Security Strategy & Executive Leadership: Define, own, and execute a comprehensive multi-year enterprise and product security roadmap. Translate business objectives, threat landscapes, and regulatory requirements into an actionable strategy. Present to executive leadership and the board on security posture, program maturity, and total risk exposure.

Product & IoT Security (Secure-by-Design): Partner with hardware, firmware, and platform engineering teams to embed security across the entire product development lifecycle. Oversee threat modeling, penetration testing, and security requirements for our hardware. Secure the Over-The-Air (OTA) update pipeline, cryptographic key management, and embedded system communications.

Cloud & Application Security: Champion a “security by design” culture for our cloud backend and customer-facing mobile applications. Integrate automated security tooling (SAST, DAST) into CI/CD pipelines and ensure the integrity of our cloud-to-device communication channels at scale.

AI & Machine Learning Security: Secure SPAN's expanding AI and machine learning infrastructure, serving as the security cornerstone for the development of our platform. Develop threat models for ML pipelines, ensure AI model integrity, protect against adversarial inputs, and establish robust data governance and privacy guardrails for AI workloads processing home energy telemetry.

Enterprise Security & Operations: Govern enterprise IT security and lead the transition toward a Zero Trust architecture. Oversee endpoint defense (EDR), identity and access management (IAM), and secure network architecture.

Vulnerability Management & Incident Response: Build and operate a world-class vulnerability management program and lead the Product Security Incident Response Team (PSIRT). Establish coordinated disclosure processes, manage bug bounty programs, coordinate third-party red team engagements, and ensure rapid triage and remediation.

Governance, Risk & Compliance (GRC): Define and author the enterprise security policy framework, ensuring alignment with global regulatory standards (e.g., SOC 2, ISO 27001, NIST) and relevant IoT/energy security standards. Oversee supply chain security, Software Bill of Materials (SBOM) practices, and third-party vendor risk.

Team Building & Mentorship: Recruit, mentor, and lead a diverse, high-performing team of security engineers, architects, and GRC specialists. Foster a culture of ownership, technical excellence, and collaboration across the global engineering organization.

About You:

Experience: 10+ years of progressive experience in cybersecurity, with at least 5 years in a security leadership role at a hardware, consumer electronics, IoT, or software-defined product company.

Technical Breadth & Depth: Deep technical expertise spanning cloud-native architectures (AWS/GCP), application security, and connected device/embedded security. You have a hands-on engineering background and the credibility to influence elite technical teams without relying solely on direct authority.

Builder Mindset: Demonstrated ability to build, scale, and up-level security programs. You are equally comfortable defining enterprise governance models as you are diving into a threat model for a new hardware feature.

Strategic Communicator: Proven track record of operating at the executive level—translating complex, deeply technical cyber risks into clear business terms for the C-suite, board members, and enterprise partners.

Compliance & Governance Expertise: Strong working knowledge of successfully steering organizations through complex compliance audits (SOC 2, ISO 27001) and implementing data governance and privacy frameworks.

Mission-Driven: A deep passion for SPAN’s mission to reinvent the electrical panel, decarbonize the residential sector, and accelerate the mass adoption of clean energy.

Education & Certifications: B.S. or M.S. in Computer Science, Computer Engineering, Cybersecurity, or equivalent practical experience. Industry-recognized leadership certifications (e.g., CISSP, CISM, CISA) are highly preferred.