Director, Application Security

About the team

Zillow’s Information Security team is the engineering-first security organization at the heart of one of the most-visited real estate platforms in the United States. We protect a product ecosystem that drives real estate transactions, safeguards the personal and financial data of millions of customers, and powers a marketplace that is reimagining what it means to come home.

We operate like a product engineering team- we build, automate, and ship. Our security engineers are embedded partners to the product and platform organizations, not gatekeepers. We move fast, we prefer paved roads over guard rails, and we treat security as a feature of the product rather than a tax on it. Our work spans cloud-native infrastructure at scale, a high-velocity application development lifecycle, real-time threat detection and response, and a threat intelligence program that informs both defensive and product risk decisions across the company.

This is a team where technical credibility matters. Our leaders write strategy documents and review detection logic and SDLC security controls. If you’ve spent your career building things - secure software, detection pipelines, App Sec programs, zero trust architectures
-this is the kind of organization you’ve been building toward.

As Director of Information Security, drive the strategy, execution, and maturity Application Security, and Security Architecture and our India Security Team. This is an M5 leadership role that reports directly to the VP, Information Security, and carries significant accountability for the security posture, talent, and engineering culture of a large, multi-function organization.

We are looking for a builder, someone who has led application security organizations inside high-growth technology companies where engineering velocity is a first-class value. You have a background that started in software engineering or security engineering, and you’ve never fully left it behind. You are the leader who can earn trust with a senior engineers and peers, recruit principal-level security engineers, and then go present business risk.

You will manage a team of managers and senior individual contributors across your four domains, partnering deeply with Platform Engineering, Product, Legal, Privacy, and Compliance. You will set multi-year technical roadmaps, own the operational budget and tooling strategy for your org, and serve as a key voice in defining the company’s overall security risk posture and investment priorities.

• Lead and develop a multi-manager organization across Application Security, and Security Architecture, setting clear direction, healthy team culture, and high-performance expectations at every level.
• Establish and execute a 2–3-year strategic roadmap for your domains that is tightly coupled to Zillow’s product and platform engineering priorities, not just industry compliance frameworks.
• Own workforce planning, org design, talent acquisition, and the development of a bench of future security leaders—with a specific focus on recruiting and retaining engineers who want to build, not just advise.
• Manage budget, tooling portfolio, and vendor relationships across your scope, with a bias toward consolidation, automation ROI, and eliminating tool sprawl.
• Represent Application Security at the executive and leadership level; translate complex technical risk into business impact for the VP

• Lead an App Sec organization that partners with product engineering rather than policing it—building “paved road” security capabilities embedded in CI/CD pipelines, frameworks, and developer tooling.
• Drive a developer-first security culture: create security enablement…