Senior Lead Information Security

About the role

Tabby, a FinTech payment provider serving over 25 million users, is looking for a Senior Lead, Information Security to lead and shape its information security function across strategic and technical domains. The role leads and owns key security programmes covering cloud security, security architecture, application security, vulnerability management, threat detection and incident response.

Key responsibilities

• Lead and contribute hands-on to security architecture and technical security reviews across cloud, infrastructure and product initiatives.
• Design and implement security controls across GCP and AWS, including IAM, CSPM and cloud-native security.
• Drive and contribute to Secure SDLC / DevSecOps, including SAST, DAST, SCA and container security.
• Lead vulnerability management and take part in penetration testing, VAPT and red/purple team engagements.
• Design and improve threat detection, SIEM use cases and security monitoring.
• Lead and take part in complex security incident investigations and response.
• Drive endpoint, infrastructure, network and firewall security initiatives.
• Automate security processes and develop security tooling where needed.
• Establish technical standards, security best practices and operating procedures.
• Support and mentor a team of security engineers and analysts.
• Work with Engineering, Infrastructure, Product, IT, Legal and Compliance teams to embed security across Tabby.

Required profile

• Strong experience leading Information Security / Cyber Security functions in a senior technical or management role.
• 5+ years in Information Security or Cybersecurity, with at least 2 years in a technical leadership or senior individual contributor role.
• Experience leading security programmes and managing cross-functional initiatives.
• Experience working within a regulated FinTech or banking environment.
• Proven stakeholder management and strategic decision-making skills.
• Cybersecurity certifications such as CISSP, CISM and OSCP are preferred or required depending on the final hiring criteria.

Required skills

• Cloud security, security architecture, VAPT, AppSec/DevSecOps and defensive security.
• GCP/AWS, IAM, CSPM, SIEM, EDR/XDR and vulnerability management.
• Penetration testing, red/purple teaming, threat hunting and incident response.
• SAST, DAST, SCA and container security within CI/CD environments.
• Security architecture, threat modelling and enterprise security controls.
• Knowledge of CBUAE, UAE PDPL, PCI-DSS, ISO 27001 and SOC 2.