Company record
Who leads security at PayPal
The most recent move CISO Tribune has on record at PayPal was announced in the week of April 22, 2024: too long ago to say who holds the seat today. The history below stands; the current holder is not yet confirmed.
Board oversight: PayPal's April 7, 2026 proxy statement names the Risk and Compliance Committee as overseeing, or receiving reports from, this seat. Full passage on our board committee oversight report. The passage in the proxy statement: “Risk and Compliance Committee David M. Moffett Chair Committee Meetings in 2025: 6 Other Members: Joy Chik, Carmine Di Sibio, Alyssa H. Henry, Ann M. Sarnoff, Deirdre Stanley Primary Responsibilities Provide assistance and guidance to the Board in fulfilling its oversight responsibilities with respect to: PayPal's overall enterprise-wide risk management framework, including the risk appetite framework, risk taxonomy and related risk management policies; The identification, assessment, management, monitoring and control of key current and emerging risks, including regulatory and financial crimes compliance, technology (including cybersecurity, information security, privacy and data protection, and AI), operational, portfolio, capital, liquidity, credit, fraud, strategic, extended enterprise, business continuity, third-party and reputational risks; PayPal's top risks, key risk indicators and associated mitigation plans, as well as the results of enterprise-wide risk assessments; The effectiveness of PayPal's risk management program, including review of periodic reports from the Chief Risk Officer, Chief Information Security Officer, Chief Technology Officer, Chief Auditor and other members of management;”
What PayPal tells the SEC
Its fiscal 2025 Form 10-K, filed February 3, 2026, carries an Item 1C cybersecurity disclosure that describes a Chief Information Security Officer. Read the section verbatim or the filing on sec.gov. A filing describes governance as of its date, not today's seat.
Tracked by the Wire since April 22, 2024 · 1 recorded move · every claim links to a sourced record · Updated
Where PayPal appears on the record (2)
Every page on CISO Tribune and its network that carries this company, 2 in all.
- On the Wire
- SEC filing
- Form 10-K cybersecurity disclosure, fiscal 2025 · Item 1C, filed February 3, 2026
About PayPal
CISO Tribune's Leadership Bench files PayPal under Financial Services and North America. The SEC classifies it under standard industrial classification 7389, Services-business services, nec, and EDGAR lists its ticker as PYPL. The Wire has one security-leadership move at PayPal on record, announced in the week of April 22, 2024.
What PayPal's 10-K says about security governance
PayPal's fiscal 2025 Form 10-K, filed February 3, 2026, describes its cybersecurity governance in Item 1C. The lines below are that filing's own statements, each with the sentence it comes from.
Top security role, as the filing names it: Chief Information Security Officer.
How often the board or committee hears about it: quarterly.
“The R&C Committee receives quarterly reports from the Chief Information Security Officer ("CISO") on our cybersecurity risks.”
Frameworks and standards the filing names: NIST Cybersecurity Framework and ISO/IEC 27001.
Experience of the security leadership, as the filing states it:
“Our CISO has over two decades of experience as a cybersecurity professional, including as a CISO at PayPal and four other organizations that include leading global financial services institutions and large-scale U.S. government agencies (including within the Department of Defense).”
Material incidents: the filing states none.
“For a description of risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition, see "Item 1A. Risk Factors" under the captions " Cyberattacks and security vulnerabilities could result in serious harm to our reputation, business, and financial condition " and " Business interruptions or systems failures may impair the availability of our websites, applications, products or services, or otherwise harm our business. "”
Plain-English reading and full text of the filing · the filing on sec.gov
Security leadership timeline
Security leaders of PayPal on our record
Shaun Khalfan: named SVP, Chief Information Security Officer (CISO), announced in the week of April 22, 2024 record
Moves by people who came from PayPal
Security chiefs at other Financial Services organizations
Other organizations CISO Tribune files under Financial Services with a named security chief on record: those in North America first, in alphabetical order from PayPal onward.
Plaid: Sean Cassidy, Chief Information Security Officer (CISO).
PNC: Christian Winward, Chief Information Security Officer.
Relm Insurance: Robert Thomas, Chief Information Security Officer (CISO).
Remitly: Jeff Lyon, Chief Information Security Officer.
SMBC Americas: Donna Hart, Chief Information Security Officer.
State Street: Elizabeth (Liz) Joyce, Chief Information Security Officer.
Stock Yards Bank & Trust: Joe Harrington, Chief Information Security Officer.
Tradeweb: Ahmed Pasha, Global Chief Information Security Officer.
Questions CISOs ask about PayPal
- Who are the security chiefs at other Financial Services organizations?
- On CISO Tribune's record they include Sean Cassidy at Plaid, Christian Winward at PNC, Robert Thomas at Relm Insurance and Jeff Lyon at Remitly.
- Which board body oversees cybersecurity at PayPal?
- PayPal's proxy statement filed April 7, 2026 names the Risk and Compliance Committee as overseeing, or receiving reports from, the security seat.
Related guides
CISO Reporting Structure, the Five Models and What the Filings Show
Most security chiefs report into technology leadership (64%), the rest to business leaders. The five models, their trade-offs and what 10-K filings show.
CISO News: Tracking Every Appointment and Departure in the Top Security Seat
CISO Tribune records every CISO appointment and departure as a sourced, dated entry, not a column: 466 moves to date, each with a primary source and a confirmed-or-reported label.
CISO, CSO, VP of Security, Head of Security: What the Titles Mean and What the Record Shows
A chief information security officer (CISO) owns information security. A chief security officer (CSO) usually adds physical security and investigations.