Head of Security at Span · LumiJobs

Responsibilities

As the Head of Security at SPAN, you will lead a high-performing security organization at the forefront of the clean energy transition. This is a critical executive leadership role responsible for the end-to-end security strategy across our entire ecosystem: spanning our smart electrical panels, embedded firmware, cloud infrastructure, mobile applications, and enterprise IT.
Security Strategy & Executive Leadership: Define, own, and execute a comprehensive multi-year enterprise and product security roadmap. Translate business objectives, threat landscapes, and regulatory requirements into an actionable strategy. Present to executive leadership and the board on security posture, program maturity, and total risk exposure.
Product & IoT Security (Secure-by-Design): Partner with hardware, firmware, and platform engineering teams to embed security across the entire product development lifecycle. Oversee threat modeling, penetration testing, and security requirements for our hardware. Secure the Over-The-Air (OTA) update pipeline, cryptographic key management, and embedded system communications.
Cloud & Application Security: Champion a “security by design” culture for our cloud backend and customer-facing mobile applications. Integrate automated security tooling (SAST, DAST) into CI/CD pipelines and ensure the integrity of our cloud-to-device communication channels at scale.
AI & Machine Learning Security: Secure SPAN's expanding AI and machine learning infrastructure, serving as the security cornerstone for the development of our platform. Develop threat models for ML pipelines, ensure AI model integrity, protect against adversarial inputs, and establish robust data governance and privacy guardrails for AI workloads processing home energy telemetry.
Enterprise Security & Operations: Govern enterprise IT security and lead the transition toward a Zero Trust architecture. Oversee endpoint defense (EDR), identity and access management (IAM), and secure network architecture.
Vulnerability Management & Incident Response: Build and operate a world-class vulnerability management program and lead the Product Security Incident Response Team (PSIRT). Establish coordinated disclosure processes, manage bug bounty programs, coordinate third-party red team engagements, and ensure rapid triage and remediation.
Governance, Risk & Compliance (GRC): Define and author the enterprise security policy framework, ensuring alignment with global regulatory standards (e.g., SOC 2, ISO 27001, NIST) and relevant IoT/energy security standards. Oversee supply chain security, Software Bill of Materials (SBOM) practices, and third-party vendor risk.
Team Building & Mentorship: Recruit, mentor, and lead a diverse, high-performing team of security engineers, architects, and GRC specialists. Foster a culture of ownership, technical excellence, and collaboration across the global engineering organization.

Qualification

ExperienceTechnical Breadth & DepthBuilder MindsetStrategic CommunicatorCompliance & Governance ExpertiseMission-DrivenEducation & Certifications⚡ Comprehensive benefits

Required

Experience: 10+ years of progressive experience in cybersecurity, with at least 5 years in a security leadership role at a hardware, consumer electronics, IoT, or software-defined product company.
Technical Breadth & Depth: Deep technical expertise spanning cloud-native architectures (AWS/GCP), application security, and connected device/embedded security. You have a hands-on engineering background and the credibility to influence elite technical teams without relying solely on direct authority.
Builder Mindset: Demonstrated ability to build, scale, and up-level security programs. You are equally comfortable defining enterprise governance models as you are diving into a threat model for a new hardware feature.
Strategic Communicator: Proven track record of operating at the executive level—translating complex, deeply technical cyber risks into clear business terms for the C-suite, board members, and enterprise partners.
Compliance & Governance Expertise: Strong working knowledge of successfully steering organizations through complex compliance audits (SOC 2, ISO 27001) and implementing data governance and privacy frameworks.
Mission-Driven: A deep passion for SPAN’s mission to reinvent the electrical panel, decarbonize the residential sector, and accelerate the mass adoption of clean energy.
Education & Certifications: B.S. or M.S. in Computer Science, Computer Engineering, Cybersecurity, or equivalent practical experience. Industry-recognized leadership certifications (e.g., CISSP, CISM, CISA) are highly preferred.
Headquartered in San Francisco’s vibrant SoMa neighborhood, we are an eclectic group of creative thinkers who value open communication, teamwork, and a ‘make it happen’ approach to addressing complex challenges.
SPAN embraces diversity and equal opportunity in a serious way. We are committed to building a team that represents a variety of backgrounds, perspectives, and skills.
We’re hiring talented individuals who are driven by success and are passionate about shaping the future of renewable energy. If that sounds like you, we’d love for you to consider joining the rapidly growing team at SPAN.
⚡ Competitive compensation + equity grants at a well-funded, venture-backed company
⚡ Comprehensive benefits: 100% employee premiums for base plans on medical, dental, vision with options for additional coverage. Parental leave up to twenty four (24) weeks depending on eligibility

Head of Security

Responsibilities

Qualification

Required

Benefits

Company

Span

More roles at Span