Head of Information Security Strategy & Risk Management

Position Summary:

Zoetis is seeking a dynamic and experienced Head of Information Security Strategy & Risk Management to lead and enhance our global security strategy, risk management, and awareness programs. This role will collaborate across Zoetis Tech & Digital and business units to embed security into the company’s DNA while maintaining a strong risk posture.

This leader will work directly with the Chief Information Security Officer to define the strategic vision for Zoetis’ information security landscape, ensuring our defenses evolve in response to emerging threats. They will align security initiatives with business objectives, enabling innovation while protecting the organization’s assets, infrastructure, and data. A key aspect of the role involves building trust and translating complex security risks into business-friendly narratives for executive leadership and stakeholders.

Responsibilities:

Strategic Leadership & Risk Management

• Develop and execute a long-term global information security strategy aligned with Zoetis' business goals.
• Lead a comprehensive risk management program, identifying, assessing, and mitigating risks across the enterprise.
• Provide regular executive-level reporting on security posture, key risk indicators, and program effectiveness.
• Partner closely with Legal, Compliance, Privacy, and HR to ensure adherence to regulatory and industry best practices.

Security Operations & Incident Response

• Oversee the Security Operations Center (SOC) to ensure 24/7/365 threat monitoring, detection, and incident response.
• Provide strategic leadership during major security incidents and guide improvements in response playbooks and recovery strategies.
• Direct execution of attack simulations, including tabletop and purple/red team exercises, to strengthen cyber resilience.

Vulnerability Management & Threat Intelligence

• Lead Vulnerability Management program to proactively identify and remediate security gaps across cloud, infrastructure, and applications.
• Drive Threat Intelligence initiatives to predict, analyze, and counteract evolving cyber threats.

Security Awareness & Business Enablement

• Design and oversee a Security Awareness Program that fosters a risk-aware culture across Zoetis.
• Partner with business functions to embed security into digital transformation initiatives, ensuring security enables—not hinders—innovation.
• Serve as a trusted liaison between the business and InfoSec, simplifying technical complexities into actionable insights.

Mergers & Acquisitions (M&A) Security

• Lead security due diligence and integration efforts for M&A activities, assessing and mitigating cyber risks.
• Standardize security measures to seamlessly incorporate acquired entities into Zoetis’ security framework.

Financial & Vendor Management

• Manage and forecast security budgets, ensuring efficient allocation of resources.
• Oversee third-party security service providers, ensuring alignment with Zoetis’ risk and security strategy.

Education and Experience:

• Bachelor’s and master’s degree in Cybersecurity, Computer Science, Business, or related field
• Relevant certifications (e.g., CISSP, CISM) are required
• 12+ years of progressive experience in cybersecurity leadership, preferably in a pharmaceutical, healthcare, or regulated industry
• Experience leading a global Fortune 500 information security program across engineering, operations, and risk domains
• Demonstrated ability to build high-performing security teams and drive organizational change
• Expertise in communicating complex security topics to executive leadership and non-technical stakeholders
• Strong background in finance and budget management, vendor oversight, and service delivery
• Experience in security governance, compliance (e.g., GDPR, HIPAA, SOX), and audit functions

Technical Skills Requirements:

• Deep expertise in security technologies across endpoint, network, and cloud environments
• Strong understanding of the threat landscape, emerging risks, and effective countermeasures
• Knowledge of system development life cycle (SDLC) and secure software development practices
• Hands-on experience managing large-scale IT and security projects

Travel: <10%

Full time

Regular

Colleague

Any unsolicited resumes sent to Zoetis from a third party, such as an Agency recruiter, including unsolicited resumes sent to a Zoeti