## About the Role erad is a Sharia-compliant fintech providing SME financing in Saudi Arabia and the UAE, licensed by the CMA in KSA and the DFSA in the UAE. We are hiring a Cybersecurity Engineer to own the security of our platform, our people and our devices. You will report to the CTO and work with a fully distributed engineering team that ships with AI-assisted tooling every day. We especially want to hear from penetration testers and security auditors who are ready to move from finding the issues to owning the fixes. ## What You'll Do **Security engineering and testing** - Own the security posture of our cloud environment: identity and access, network exposure, host hardening and patching, secrets, and logging coverage. - Test our own products the way an attacker would: regular internal pentests of our web apps and APIs, plus scoping and retests with external testers. - Build and run vulnerability management across code, dependencies, hosts and third-party software, with remediation SLAs tracked to closure. - Review designs and pull requests with engineers, and build security into our delivery pipeline. **Detection and response** - Own security alerting and keep it useful rather than noisy. - Lead incident response end to end: triage, containment, investigation, root cause and the write-up for management and regulators. - Run phishing awareness, tabletop exercises and restore tests. **Governance and compliance** - Run our ISMS: control evidence, risk register, policies, vendor security reviews, access reviews and audit support. - Turn regulatory requirements (CMA, DFSA, and KSA and UAE data protection law) into practical controls and evidence. **IT (around 20% of your time)** - Run joiner, mover and leaver access: accounts, SSO, app roles, offboarding and data handover. - Manage company laptops through MDM: enrolment, configuration, encryption and app deployment. - Administer our identity and collaboration tools, the company password manager and MFA. - Automate the repetitive parts so IT stays a small slice of the job. ## Qualifications & Experience - 3+ years in security, ideally including time as a penetration tester or security auditor at a pentest firm, security consultancy or compliance platform. - Hands-on web application, API and cloud penetration testing: you can find and exploit real vulnerabilities, write them up clearly, and work with engineers on the fix. - Practical security experience on at least one major cloud provider: IAM, network controls and logging. - Experience with WAF and zero-trust access tooling. - Strong Linux and networking fundamentals: SSH, TLS, DNS, firewalls and VPNs. - Comfortable writing automation in Python or Bash, and reviewing application code for security issues (OWASP Top 10). - Incident response experience, including investigating from raw logs. - Familiarity with ISO 27001 or SOC 2 controls and producing audit evidence. - Some experience administering an identity provider and managing devices with an MDM. - Uses AI tools to work faster and checks their output critically. - Fluent English, written and spoken. ## Skills (Nice-to-Haves) - Experience in fintech, banking or other regulated financial services, ideally with GCC regulators. - Certifications such as OSCP, OSWE, CREST, CISSP, CCSP, a cloud provider security certification, or ISO 27001 Lead Implementer or Lead Auditor. - Container security, infrastructure as code and CI/CD security. - Knowledge of the Saudi and UAE personal data protection laws. - Red-team experience, published CVEs, bug bounty findings or CTF results. - Experience as the first or only security engineer at a startup. - Arabic is a plus.
Job details are sourced from the employer's original posting.
Open job posting