Security Lead

We are looking for a hands-on Security Lead to own the security of the whole platform end to end and make Bamboo Card a hard target. You will find weaknesses before attackers do, build security into how we design and ship, and lead the response when something goes wrong. You will set the strategy, but you will also review architecture, read code, dig into logs, and harden systems yourself. Technical Expertise 10+ years in information security, with at least 3 years in a lead or senior role. Deep, hands-on experience securing production AWS environments. Strong web application and API security: OAuth2/OIDC, mTLS, API gateways, WAF, rate limiting, and bot protection. Experience protecting systems that handle sensitive or financial data, including fraud and account takeover scenarios. Real incident response experience, not just writing the runbook. Comfortable reading code and reviewing architecture; .NET, SQL Server, or GitHub Actions background is a plus. Working knowledge of GDPR, UAE PDPL, and frameworks such as ISO 27001, SOC 2, NIST, or CIS. Leadership & Communication Explains risk clearly to engineers, executives, and clients, and pushes back when needed. Influences teams without slowing them down; balances security with delivery. Experience building or scaling a security function is a strong advantage. Certifications such as OSCP, CISSP, CCSP, or AWS Security Specialty, and a background in payments, fintech, or gift cards, are a plus. Security Strategy & Governance Own the security roadmap across infrastructure, applications, APIs, and data, and report security posture and risk to the CTO and leadership. Define and maintain security policies, standards, and a living risk register. Build out the security function as the company grows, including tooling, processes, and future hires. Application, API & Identity Security Protect the public B2B and B2C portals and partner APIs against OWASP Top 10 attacks, API abuse, credential stuffing, bots, and fraud patterns. Own identity and access security for customers and staff: Cognito, SSO, MFA, session management, and account takeover prevention. Secure data exchange between departments, suppliers, and marketplaces: authentication, authorisation, encryption, and secrets management. Work with the purchase monitoring team to detect abnormal client activity and fraud early. Cloud & Infrastructure Security Harden our AWS environment: IAM and IAM Identity Center, network segmentation, KMS, WAF, Shield, GuardDuty, Security Hub, and CloudTrail. Enforce least-privilege access across AWS accounts, GitHub, and internal tools, with regular access reviews. Partner with the DevOps team to embed security in infrastructure as code and GitHub Actions pipelines. Secure Development Run threat modelling for new features and integrations, and review high-risk designs and code. Integrate SAST, DAST, dependency, secret, and container scanning into CI/CD, with clear fix SLAs. Train engineers on secure coding and make the secure path the easy path. Detection, Response & Testing Build monitoring, detection, and alerting (SIEM, GuardDuty, CloudWatch) with actionable alerts. Own the incident response plan; lead incidents from detection through containment, client communication, and post-mortem. Run vulnerability management, coordinate external penetration tests, and make sure findings get fixed. Run tabletop exercises and maintain business continuity and disaster recovery plans with engineering. Compliance, Vendors & Awareness Drive GDPR, UAE PDPL, and other regional data protection requirements; lead us towards ISO 27001 or SOC 2. Assess the security of suppliers, marketplaces, and third-party vendors before and during integration. Run security awareness and phishing training across the company and be the go-to person for security questions. Technical Expertise 10+ years in information security, with at least 3 years in a lead or senior role. Deep, hands-on experience securing production AWS environments. Strong web application and API security: OAuth2/OIDC, mTLS, API gateways, WAF, rate limiting, and bot protection. Experience protecting systems that handle sensitive or financial data, including fraud and account takeover scenarios. Real incident response experience, not just writing the runbook. Comfortable reading code and reviewing architecture; .NET, SQL Server, or GitHub Actions background is a plus. Working knowledge of GDPR, UAE PDPL, and frameworks such as ISO 27001, SOC 2, NIST, or CIS. Leadership & Communication Explains risk clearly to engineers, executives, and clients, and pushes back when needed. Influences teams without slowing them down; balances security with delivery. Experience building or scaling a security function is a strong advantage. Certifications such as OSCP, CISSP, CCSP, or AWS Security Specialty, and a background in payments, fintech, or gift cards, are a plus.