ZALORA is Asia’s leading online fashion, beauty and lifestyle destination, part of Global Fashion Group. As one of the region’s pioneer large scale e-commerce platforms, ZALORA has established a strong presence throughout the region, particularly in Singapore, Indonesia, Malaysia, Brunei, the Philippines, and Hong Kong, enjoying over 50 million visits per month.
ABOUT THE ROLE
Zalora, one of GFG’s e-commerce platforms, is hiring a security leader to build and run day-to-day security for Zalora — leading, staffing, and prioritizing the work of a small security team, in close collaboration with GFG’s group-level security function. This is a “player-coach” role: you align with the Group CISO’s overall security strategy, but you own how that strategy gets executed for Zalora, staying hands-on where it matters — reviewing architectures, hardening cloud environments, and acting as the senior technical escalation point when incidents happen.
You’ll work closely with Zalora engineering and business stakeholders to keep secure-by-design practices in place, including for AI/LLM features, while managing Zalora’s security team and coordinating external specialist consultants when needed.
WHAT WILL YOU DO
Team Leadership & Stakeholder Management
Lead, mentor, and grow Zalora’s security team — set priorities, review work, and develop team members’ skills.
Own hiring and resourcing input for the team, including when to bring in external specialist consultants versus building in-house capability.
Act as the primary point of contact between security and Zalora business/engineering leadership, translating security risk into business terms and negotiating trade-offs.
Represent Zalora’s security posture and priorities in group-level conversations with the Global CISO organization.
Hands-On Security Engineering
Execute security architecture reviews for new and existing systems, and validate cloud security posture (primarily AWS, also GCP).
Implement and maintain IAM strategies, zero trus t controls, and infrastructure-as-code security.
Integrate security automation into CI/CD pipelines and DevSecOps workflows.
Secure containerized environments (Docker, Kubernetes).
Application & AI/LLM Security
Run threat modeling, SAST/DAST, and mobile application security testing on key systems.
Review AI-driven features and LLM integrations for risks such as prompt injection, data leakage, and supply chain vulnerabilities, and recommend concrete mitigations.
Apply existing AI/LLM security standards (e.g., OWASP Top 10 for LLM Applications) to real reviews, rather than authoring group-wide policy.
Incident Response, Testing & Team Coordination
Act as the senior technical escalation point during active incidents, leading technical response and remediation.
Run penetration testing and red-team exercises (internally or via external consultants), and track findings through to fix.
Manage relationships with external vendors and specialist consultants for pentesting, AI security, and peak-demand coverage.
WHAT WE ARE LOOKING FOR
General qualifications
7–10+ years of hands-on experience in security engineering, product security, or infrastructure security (not purely strategy/GRC roles).
Comfortable being the technical decision-maker under pressure — e.g., during a live incident or a contested architecture review.
Able to explain a technical finding (e.g., a vulnerability or misconfiguration) clearly to a non-technical stakeholder.
Experience leading or building a security team — direct people-management experience preferred, technical/task leadership of a team at minimum.
Experience in fashion or retail e-commerce is a plus, not required.
Technical Expertise
Strong, hands-on AWS security experience (IAM, network security, security services); working knowledge of GCP.
Practical experience with SAST/DAST tooling, threat modeling, and mobile application security testing.
Working knowledge of AI/ML security risks and frameworks (OWASP Top 10 for LLM Applications, NIST AI…