Head of Information Security

About the role

TerraStakes is building a platform that tokenizes income-generating UAE real estate into diversified investment portfolios, and is currently pre-licensed and under development. The Head of Information Security owns information security, technology risk and data protection across the company, including governance and controls, key and signing governance, identity and access, application and cloud security, investor data protection, detection and response, fraud prevention and third-party assurance. The role reports to the CEO, not the CTO, so that security assurance does not sit inside the function it assures.

Key responsibilities

• Build the information security management system: policies, standards, control framework, risk register, exceptions and the governance forum that keeps it alive.
• Set the risk appetite with the founders and own the security content of regulatory submissions and the evidence behind every assertion.
• Govern key material, signing thresholds, separation of duties and ceremonies, and enforce maker-checker on privileged actions; assure the boundary with licensed custodians and wallet providers.
• Identity and access management across cloud, code, data and admin interfaces, plus a joiner-mover-leaver process and vetting for roles touching keys, client money or investor data.
• Secure development lifecycle, cloud posture, network segmentation, infrastructure as code review and build/release integrity.
• Data protection under UAE federal and free zone regimes, minimization by design, vendor data processing terms and cross-border transfer controls.
• Logging and monitoring, incident response plan, business continuity and disaster recovery, and fraud prevention including out-of-band confirmation on payments.
• Third-party risk register, commissioning penetration testing and red teaming, hosting external audits and regulator inspections, and reporting security posture to the founders.
• Build and lead the security function from one person upward, and write clearly for regulators, auditors and the board.

Required profile

• 8+ years in information security, including time in a regulated financial institution, exchange, custodian, bank or licensed digital asset business.
• Has built a security program from a low base and can show what was built.
• Hands-on depth in at least two of cloud security, application security, cryptographic key management or detection and response.
• Practical key management and signing controls, including HSMs and multi-party or threshold schemes.
• Has handled a real incident, including one that went badly.
• Regulator- or auditor-facing work and the ability to write for that audience.
• Working knowledge of data protection and how it translates into system design.
• Preferred: digital asset or tokenization experience, familiarity with UAE regulatory regimes, standing up an ISMS to a recognized standard, Arabic alongside English; certifications help but hands-on evidence carries more weight.