Cybersecurity Engineer (Cloud & IT) - Remote
4 дн. назад
от 2500 USD / мес.Страна неизвестнаRemote
penetration testingsecurity auditingvulnerability managementincident responsecloud security
Responsible for securing cloud and IT environments, conducting pentests, managing vulnerabilities, and leading incident response in a fintech company.
Обязанности
- is a Sharia-compliant fintech providing SME financing in Saudi Arabia and the UAE, licensed by the CMA in KSA and the DFSA in the UAE. We are hiring a Cybersecurity Engineer to own the security of our platform, our people and our devices. You will report to the CTO and work with a fully distributed engineering team that ships with AI-assisted tooling every day. We especially want to hear from penetration testers and security auditors who are ready to move from finding the issues to owning the fixes.
Требования
- 3+ years in security, ideally including time as a penetration tester or security auditor at a pentest firm, security consultancy or compliance platform.
- Hands-on web application, API and cloud penetration testing: you can find and exploit real vulnerabilities, write them up clearly, and work with engineers on the fix.
- Practical security experience on at least one major cloud provider: IAM, network controls and logging.
- Experience with WAF and zero-trust access tooling.
- Strong Linux and networking fundamentals: SSH, TLS, DNS, firewalls and VPNs.
- Comfortable writing automation in Python or Bash, and reviewing application code for security issues (OWASP Top 10).
- Incident response experience, including investigating from raw logs.
- Familiarity with ISO 27001 or SOC 2 controls and producing audit evidence.
- Some experience administering an identity provider and managing devices with an MDM.
- Uses AI tools to work faster and checks their output critically.
- Fluent English, written and spoken.
Будет плюсом
- Experience in fintech, banking or other regulated financial services, ideally with GCC regulators.
- Certifications such as OSCP, OSWE, CREST, CISSP, CCSP, a cloud provider security certification, or ISO 27001 Lead Implementer or Lead Auditor.
- Container security, infrastructure as code and CI/CD security.
- Knowledge of the Saudi and UAE personal data protection laws.
- Red-team experience, published CVEs, bug bounty findings or CTF results.
- Experience as the first or only security engineer at a startup.
- Arabic is a plus.
Другое
- Own the security posture of our cloud environment: identity and access, network exposure, host hardening and patching, secrets, and logging coverage.
- Test our own products the way an attacker would: regular internal pentests of our web apps and APIs, plus scoping and retests with external testers.
- Build and run vulnerability management across code, dependencies, hosts and third-party software, with remediation SLAs tracked to closure.
- Review designs and pull requests with engineers, and build security into our delivery pipeline.
- Own security alerting and keep it useful rather than noisy.
- Lead incident response end to end: triage, containment, investigation, root cause and the write-up for management and regulators.
- Run phishing awareness, tabletop exercises and restore tests.
- Run our ISMS: control evidence, risk register, policies, vendor security reviews, access reviews and audit support.
- Turn regulatory requirements (CMA, DFSA, and KSA and UAE data protection law) into practical controls and evidence.
- Run joiner, mover and leaver access: accounts, SSO, app roles, offboarding and data handover.
- Manage company laptops through MDM: enrolment, configuration, encryption and app deployment.
- Administer our identity and collaboration tools, the company password manager and MFA.
- Automate the repetitive parts so IT stays a small slice of the job.