Security Lead

About the Role
We are seeking a hands-on Security Lead to take ownership of the entire platform's security and transform the company into a hard target against threats. In this role, you will proactively identify vulnerabilities before attackers do, integrate security into our design and shipping processes, and lead incident response efforts when security issues arise. Your responsibilities will span security strategy, application and infrastructure security, secure development practices, detection and response, compliance, and fostering security awareness across the organization.

Responsibilities
Security Strategy & Governance

• Own the security roadmap across infrastructure, applications, APIs, and data, reporting the security posture and associated risks to the CTO and leadership.
• Define and maintain security policies, standards, and a living risk register.
• Build out the security function as the company expands, including the necessary tooling, processes, and future hires.

Application, API & Identity Security

• Protect public B2B and B2C portals and partner APIs from OWASP Top 10 attacks, API abuse, credential stuffing, bots, and fraud patterns.
• Own identity and access security for both customers and employees, including management of Cognito, SSO, MFA, session management, and account takeover prevention.
• Secure data exchange between various departments, suppliers, and marketplaces focusing on authentication, authorization, encryption, and secrets management.
• Collaborate with the purchase monitoring team to detect abnormal client activity and potential fraud early on.

Cloud & Infrastructure Security

• Harden the AWS environment: IAM and IAM Identity Center, network segmentation, KMS, WAF, Shield, GuardDuty, Security Hub, and CloudTrail.
• Enforce least-privilege access across AWS accounts, GitHub, and internal tools, conducting regular access reviews.
• Work alongside the DevOps team to integrate security into infrastructure as code and GitHub Actions pipelines.

Secure Development

• Conduct threat modeling for new features and integrations, and review high-risk designs and code.
• Integrate SAST, DAST, dependency, secret, and container scanning into CI/CD processes with clear fix Service Level Agreements (SLAs).
• Provide training to engineers on secure coding practices to ensure that the secure path is also the easy path.

Detection, Response & Testing

• Build monitoring, detection, and alerting systems (via SIEM, GuardDuty, CloudWatch) that generate actionable alerts.
• Own and manage the incident response plan; lead incidents from detection through containment, client communication, and post-mortem analysis.
• Oversee vulnerability management, coordinate external penetration tests, and ensure findings are addressed.
• Conduct tabletop exercises and maintain business continuity and disaster recovery plans in collaboration with the engineering team.

Compliance, Vendors & Awareness

• Drive compliance with GDPR, UAE PDPL, and other relevant regional data protection laws; work towards achieving ISO 27001 or SOC 2 certification.
• Assess the security of suppliers, marketplaces, and third-party vendors both before and during integration.
• Facilitate security awareness and phishing training across the company, becoming the go-to resource for security inquiries.

Requirements

• 10+ years of experience in information security, with at least 3 years in a lead or senior role.
• Extensive hands-on experience securing production AWS environments.
• Strong knowledge of web application and API security, including OAuth2/OIDC, mTLS, API gateways, WAFs, rate limiting, and bot protection.
• Experience in protecting systems that manage sensitive or financial data, including scenarios involving fraud and account takeovers.
• Practical incident response experience rather than solely theoretical knowledge.
• Proficiency in reading code and reviewing architecture; familiarity with .NET, SQL Server, or GitHub Actions is advantageous.
• Working knowledge of GDPR, UAE PDPL, and standards such as ISO 27001, SOC 2, NIST, or CIS.

Leadership & Communication

• Ability to clearly explain risk to engineers, executives, and clients, and capable of pushing back when necessary.
• Ability to influence teams without hindering progress; finds a balance between maintaining security and facilitating delivery.
• Experience in building or scaling a security function is highly beneficial.
• Relevant certifications such as OSCP, CISSP, CCSP, or AWS Security Specialty, along with a background in payments, fintech, or gift cards, are a plus.

Benefits

• Real ownership of security for a fast-growing global digital gifting platform.
• Competitive salary and benefits package tailored to the UAE market, including visa sponsorship, health insurance, and additional perks.
• Direct line to the CTO and significant influence over security tooling, architecture, and strategic priorities.
• A diverse, entrepreneurial technology team that values ownership, accuracy, and continuous improvement.
• Opportunity to play a key role in the company's growth as we scale our platform and expand into new markets.