Director - Security Assurance

Leads the Security Assurance vertical and is responsible for providing assurance that the CoinDCX applications, infrastructure and security controls are designed and operating securely in line with industry standards and internal policies.

Responsibilities:

• Security Assessments: Conduct in-depth penetration testing, secure code reviews, and threat modelling for product and underlying technology components
• Code and Infrastructure Security: Lead teams that perform vulnerability assessments and triage of outputs from automated scanning. Ensure the right prioritisation and governance over the remediation.
• Bug Bounty Management: Lead the bug bounty program for the group, ensuring the right processes are in place for the validation and support for reported vulnerabilities, ensuring fast, accurate assessment of threats.
• External audits and regulatory engagements: Lead activities including coordination of audit walkthroughs and fulfilment of evidence requirements for any security-related audit or regulatory activities, including close collaboration with cross-functional teams to deliver audit outcomes as needed.
• Control Testing: Lead the design and implementation of an independent testing framework for security controls. Guide the team to ensure timely Identification and analysis of process and control gaps, develop remediation recommendations, and ensure these are tracked to completion.
• Security Assurance and Sign-offs: Build and ensure the effective operation of security assurance sign-offs to verify that security design and architecture recommendations arising from security reviews for the existing, future implementations and new features are implemented appropriately.
• Secure Design Training - Design and execute security awareness initiatives to educate engineering managers and developers on secure architecture, coding and testing.
• Continuous Improvement: Continuously review and align the secure development lifecycle to industry standards, evolving threat landscape, OWASP development guides, and privacy-related guides. Stay current with the rapidly evolving crypto space, researching new vulnerabilities and attack vectors.
• Cross-functional Collaboration: Collaborate with product and engineering leads to ensure the prioritisation and fixing of vulnerabilities in a timely and efficient manner.
• Threat Research: Stay current with the rapidly evolving crypto space, ensuring that the team are actively researching new vulnerabilities and attack vectors.
• Automation Development: Build security tools and frameworks to automate manual testing processes.

Requirements:

• Bachelor's degree in computer science, engineering or related field.
• 12 + years of experience in Information security and related technologies.
• Prior experience working in financial services or fintech.
• Successful demonstrated experience managing and working with internal cross-functional teams and product engineering groups.
• Experience with driving Secure SDLC activities, DevSecOps (CI/CD) and agile software development practices.
• Experience in designing and analysing security solutions with a deep understanding of Identity and access management, cloud & infrastructure security, application security, data & network security, security governance, etc.
• Sound understanding of security by design principles and architecture-level security concepts.
• Strong leadership skills and the ability to coach and mentor other members of the Product Security teams.
• Experience with penetration testing methodologies and tools, including security analysis, audits and reviews.
• Sound knowledge of OWASP Top 10 and SANS 25
• Knowledge and experience with security standards such as CCSS (CryptoCurrency Security Standard), NIST, ISO 27001/2 CSA, SOC 1& 2 and CIS.
• One or more certifications - CISSP, TOGAF/SABSA or Cloud security certifications.
• Ability to convey security concepts to both technical and non-technical audiences.
• Excellent written and verbal communication skills, interpersonal and presentation skills and the proven ability to influence and communicate effectively.