Chief Information Security Officer

Description

We are looking for a hands-on, business-oriented Chief Information Security Officer (CISO) in Petah Tikva to lead our information security strategy and strengthen security across our digital platforms, cloud infrastructure, applications, and organizational systems.

This role requires a combination of strategic leadership, deep technical expertise, and the ability to work closely with R&D, DevOps, Product, IT, Trust & Safety, and executive management.

Key Responsibilities:

Security Strategy & Risk Management

• Develop and lead the company's information security and cybersecurity strategy, aligned with business objectives.
• Conduct security risk assessments, identify vulnerabilities, and establish mitigation plans.
• Build and manage security roadmaps, budgets, policies, KPIs, and reporting to senior management and the Board.
• Lead security governance, internal controls, vendor risk management, and audit readiness.

Cloud & Infrastructure Security

• Lead security initiatives across AWS cloud infrastructure, Kubernetes, containerized environments, and microservices.
• Implement and maintain Identity and Access Management (IAM) controls, including MFA, least privilege, privileged access management, and periodic access reviews.

Application Security & Secure Development

• Drive Application Security (AppSec) practices across web applications, mobile applications, backend services, and APIs.
• Implement and improve secure SDLC processes, including SAST, DAST, SCA, and security testing within CI/CD pipelines.
• Provide security architecture guidance, threat modeling, and secure coding recommendations to R&D teams.
• Lead penetration testing, vulnerability assessments, and remediation tracking.
• Ensure appropriate data protection and secure separation between production and non-production environments.

Platform Security, Bot Protection & Trust & Safety

• Lead technical protection against malicious bots, automated attacks, unauthorized data scraping, and platform abuse.
• Oversee security controls such as WAF, bot management, API protection, and rate limiting.
• Work closely with Trust & Safety, Product, and R&D teams to identify and mitigate account compromise, fraud-related security risks, and suspicious automated activity.

Incident Response & Business Continuity

• Develop and maintain incident response procedures for cyberattacks, ransomware, data breaches, and other security incidents.
• Coordinate incident investigations, containment, recovery, and post-incident reviews.
• Conduct security exercises and improve organizational readiness.
• Support business continuity and disaster recovery planning.

Compliance, Privacy & Security Awareness

• Ensure alignment with applicable Israeli privacy and data protection requirements, including the Israeli Privacy Protection Law, Data Security Regulations, and Amendment 13.
• Apply recognized security frameworks and methodologies, including ISO 27001, NIST, OWASP, and relevant Israeli cybersecurity guidance.

Requirements

Requirements:

• 6+ years of professional experience in Information Security or Cybersecurity, including proven experience leading security initiatives, teams, or security programs.
• Previous experience as a CISO, Head of Information Security, Security Manager, or a senior security professional with broad security ownership.
• Strong hands-on technical experience in Cloud Security, preferably AWS, including cloud architecture, IAM, and infrastructure protection.
• Practical understanding of Kubernetes, Docker, microservices, and modern cloud-native architectures.
• Proven experience with Application Security (AppSec), secure software development, API security, and CI/CD security.
• Experience defining and implementing security policies, risk assessments, vulnerability management, and incident response procedures.
• Strong understanding of Israeli privacy and information security regulations, as well as ISO 27001, NIST, and OWASP principles.
• Experience working closely with R&D, DevOps, Product, and IT teams in a technology-driven organization.
• Ability to translate complex technical security risks into clear business recommendations for senior management.
• Strong communication, leadership, decision-making, and cross-functional collaboration skills.
• Hands-on mindset, with the ability to combine strategic ownership and practical security execution.

Nice to Have:

• Experience in large-scale B2C platforms, digital marketplaces, high-traffic websites, or SaaS/product companies.
• Experience with bot management and anti-scraping solutions such as Cloudflare, Akamai, HUMAN, or DataDome.
• Experience securing data-intensive environments, including MongoDB, Elasticsearch, Kafka, and distributed systems.
• Software development, DevSecOps, or security engineering background.
• Relevant security certifications such as CISSP, CISM, or CCSP.
• Experience with fraud prevention, account protection, and Trust & Safety security challenges.