{"id":3404718,"url":"https://alion.io/job/divar-head-of-security","title":"Head of Security","company":{"id":62484,"name":"Divar","domain":"divar.ir","url":"https://alion.io/company/divar","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":true,"listed_via":null,"ats_vendor":"Workable","truth_index":{"grade":"A","score":95,"open_postings":3,"ghost_share":0,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":363,"computed_at":"2026-11-01T06:10:25Z"}},"role":"Leadership","role_family":"Leadership","seniority":"head","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Tehran, Iran"],"countries":["IR"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":53000,"max_usd":118000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":4188},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Apache Kafka","optional":false},{"name":"CI/CD","optional":false},{"name":"Go","optional":false},{"name":"ISO 27001","optional":false},{"name":"Kubernetes","optional":false},{"name":"Linux","optional":false},{"name":"NIST CSF","optional":false},{"name":"Python","optional":false},{"name":"Red Teaming","optional":false},{"name":"SQL","optional":false},{"name":"Ansible","optional":true},{"name":"eBPF","optional":true},{"name":"Kyverno","optional":true},{"name":"SLSA","optional":true},{"name":"Terraform","optional":true}],"status":"live","first_seen_at":"2026-10-28T15:47:43Z","employer_posted_date":"2026-10-28","last_verified_at":"2026-11-01T22:11:13Z","board_verified":true,"closed_at":null,"days_open":4,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":4},"description":"About Divar. Millions of people use Divar to buy, sell, rent and hire. We run most of the platform ourselves: bare-metal and virtualized infrastructure across several data centers, Kubernetes, Go and Python microservices, Kafka, a range of SQL and NoSQL databases, distributed storage, and our own CI/CD - plus Android, iOS and web clients. That makes securing it our job too.\nHow security works at Divar. Each infrastructure and product team owns the security of what it builds and runs. A security chapter - engineers who sit inside the infrastructure, backend, mobile, and web tribes - sets the bar with them, helps them meet it, and checks the result. Platform teams turn recurring controls into safe defaults. Specialist work such as incident response retainers, threat hunting, forensics, and red teaming is done with outside partners, under our direction and without standing access.\nThe role. You lead the security chapter and own Divar's security program end to end: the standard, the roadmap, the risk register, and the results. You report to the CTO, meet the CEO in a quarterly security steering review, and can take a critical risk straight to the founder when it isn't being addressed.\nWhat makes a Head of Security at Divar?\nYou're an engineer first. You can review a Kubernetes admission policy, a CI runner's isolation, or a backup design and tell whether it actually protects anything.\nYou think about risk, not checklists. 100% compliance isn't the goal. You choose controls that reduce real risk, and you document the risks we accept, who owns them, and when we'll review them again.\nYou measure progress. \"We're hardened\" isn't an answer. \"73% of CIS Level 1 controls pass, and every failure has a documented exception\" is.\nYou lead through people you don't manage. Chapter members report to their tribe leads; system owners report to theirs. You make the model work through clear standards, agreed priorities, and follow-through.\nYou plan for the worst. Data loss, losing a data center, power shortages, or losing international connectivity are scenarios you plan for and practice, not footnotes.\nYou're honest about trade-offs. You can tell leadership what a decision costs in risk, money, and team capacity, and you're willing to say \"not now.\"\nYour first year\nMonth 1: Get to know the people, products, and stack. Review the security roadmap already underway across the datacenter, production platform, CI/CD, data, and client teams. Check its metrics and name the top risks.\nMonths 2-3: Take ownership of the roadmap. Get the security charter approved: company-wide standard, exception process, risk acceptance, and remediation deadlines. Agree each chapter member's priorities with their tribe lead. Put the incident response partner under contract.\nMonths 4-12: Security posture is measured and reported every quarter. Asset inventory is complete and visible. Recovery drills run on a schedule. Hardening reaches the remaining data stores. Security is part of every design review and every release gate. By then we'll rely on your judgment to tell us what comes next.\nWe'll judge your success by how much risk goes down and how much more resilient we become, not by how many policies or tools you introduce.\nRequirements\n9+ years in security, infrastructure, or software engineering, including 3+ years leading security teams or company-wide security programs.\nDeep hands-on knowledge of Linux, networking, Kubernetes, and virtualization, in on-premises and bare-metal environments.\nPractical experience applying CIS, NIST CSF, or ISO 27001 with measurable results, not just running audits.\nExperience leading incident response under pressure, including working with external response partners.\nExperience hiring and mentoring engineers and leading through managers and teams who own delivery.\nClear written communication with both engineers and executives.\nPreferred qualifications\nAn earlier career as a software, infrastructure, or security engineer.\nSoftware supply chain security: SLSA, artifact signing and provenance, SBOMs, secret management.\nBusiness continuity and disaster recovery: business impact analysis, RTO/RPO, restore testing and drills.\nA solid grasp of application, mobile and web security, identity and access management, and cryptography.\nPolicy as code (Kyverno or OPA), eBPF or auditd runtime security, Terraform or Ansible.\nRunning systems with limited connectivity or limited vendor access, such as offline mirrors and air-gapped builds.\nSecurity experience at a large online platform or marketplace.\nCertifications such as CISSP, OSCP, or CKS are a plus but not required.\nBenefits\nReal impact: You'll protect a platform millions of people use every day.\nAuthority and access: A written charter, a direct line to the CTO, and a quarterly review with the CEO.\n Strong engineering peers: You'll work with engineers who care about doing things right.\nFlexible working hours, health insurance, and a culture that values learning and autonomy.","description_format":"text","description_chars":4993,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Flexible schedule","Health insurance"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Online Classifieds"],"lifecycle":[{"event":"open","at":"2026-10-28T15:47:43Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":3,"expected_fill_days":363,"reasons":["conf:0","velocity","win:early"],"computed_at":"2026-11-01T06:10:25Z"},"pay":null,"html_url":"https://alion.io/job/divar-head-of-security","json_url":"https://alion.io/job/divar-head-of-security.json","meta":{"generated_at":"2026-11-02T01:43:45Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":2685,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-03T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":62484},"rest":"https://alion.io/mcp/rest/get_company?id=62484"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fdivar-head-of-security"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fdivar-head-of-security"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fdivar-head-of-security"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/divar-head-of-security\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fdivar-head-of-security"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3404718}},{"tool":"search_jobs","arguments":{"company":"divar.ir","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3404718},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}