Security Lead

About the role

Bamboo Card, a Dubai-based B2B distributor of digital prepaid products and rewards fulfilment partner, is looking for a hands-on Security Lead to own the security of its platform end to end. The role sets the security strategy while also reviewing architecture, reading code, digging into logs and hardening systems. It sits in a fast-growing payments ecosystem and offers a direct line to the CTO.

Key responsibilities

• Own the security roadmap across infrastructure, applications, APIs and data, and report security posture and risk to the CTO and leadership
• Define and maintain security policies, standards and a living risk register, and build the security function as the company grows
• Protect portals and partner APIs against OWASP Top 10 attacks, API abuse, credential stuffing, bots and fraud
• Own identity and access security (Cognito, SSO, MFA, session management, account takeover prevention) and secure data exchange between departments, suppliers and marketplaces
• Harden the AWS environment (IAM, IAM Identity Center, network segmentation, KMS, WAF, Shield, GuardDuty, Security Hub, CloudTrail) and enforce least-privilege access with regular reviews
• Embed security in infrastructure as code and GitHub Actions pipelines with the DevOps team
• Run threat modelling, integrate SAST, DAST, dependency, secret and container scanning into CI/CD, and train engineers on secure coding
• Build monitoring, detection and alerting (SIEM, GuardDuty, CloudWatch), own the incident response plan and lead incidents through containment, client communication and post-mortem
• Run vulnerability management, coordinate external penetration tests and maintain business continuity and disaster recovery plans
• Drive GDPR, UAE PDPL and other data protection requirements, assess vendor security, and run security awareness and phishing training

Required profile

• 10+ years in information security, with at least 3 years in a lead or senior role
• Deep, hands-on experience securing production AWS environments
• Experience protecting systems handling sensitive or financial data, including fraud and account takeover scenarios
• Real incident response experience, not just writing the runbook
• Comfortable reading code and reviewing architecture
• Experience building or scaling a security function is a strong advantage

Required skills

• AWS (IAM, IAM Identity Center, KMS, WAF, GuardDuty, Security Hub, CloudTrail)
• Web application and API security: OAuth2/OIDC, mTLS, API gateways, rate limiting, bot protection
• Working knowledge of GDPR, UAE PDPL and frameworks such as ISO 27001, SOC 2, NIST or CIS
• Certifications such as OSCP, CISSP, CCSP or AWS Security Specialty are a plus; a background in payments, fintech or gift cards is a plus

What we offer

• Competitive salary and benefits package aligned to the UAE market (visa, health insurance and additional benefits)
• Direct line to the CTO and influence over security tooling, architecture and priorities
• A diverse, entrepreneurial technology team