Security Manager

We are hiring a Security Manager to own our security and compliance program end to end. Most of the

role is Governance, Risk and Compliance (GRC): building the framework, running audits, and keeping us

aligned with regulators and partners. The rest is hands-on assurance: you can scope and challenge a

penetration test, and you understand cloud and infrastructure security well enough to set direction for

engineering.

Key Responsibilities:

Governance, risk and compliance

• Own the information security management system: policies, standards, procedures and the controls library.
• Lead certification and audit programs (ISO 27001, SOC 2, PCI DSS where in scope), from gap assessment through external audit and continuous monitoring.
• Run our compliance automation platform (e.g. Vanta): control mapping, evidence collection, and keeping integrations accurate.
• Map and maintain compliance with Egyptian regulation, including FRA consumer finance requirements, Central Bank of Egypt guidance where applicable, and the Personal Data
• Protection Law (Law 151 of 2020).
• Maintain the enterprise risk register: identify, score and track security and technology risks, and report them to leadership and the board.
• Run third-party and vendor risk management, including security reviews of merchants, banks,
• KYC and cloud providers.
• Handle security questionnaires and due diligence from banks, card networks, partners and investors.
• Own business continuity and disaster recovery planning, and test it at least yearly.

Security assurance and penetration testing

• Define the yearly testing plan across web, mobile, API and cloud.
• Scope, procure and manage external penetration testers and red-team engagements; challenge findings and severity ratings.
• Run or validate internal testing where useful, using tools such as Burp Suite, OWASP ZAP or Nmap.
• Own the vulnerability management lifecycle: triage, SLAs by severity, remediation tracking and retesting.
• Embed secure SDLC practices with engineering: threat modelling, secure code review guidance,
• and SAST, DAST, SCA and secrets scanning in CI/CD.

Infrastructure and cloud security

• Set the security baseline for cloud (AWS/GCP), Kubernetes and containers, networks and endpoints.
• Own identity and access management: least privilege, MFA, privileged access, joiner-mover-leaver and periodic access reviews.
• Define encryption, key management and data protection standards, including handling of PII and payment data.
• Oversee logging, monitoring and detection (SIEM, cloud security posture management) together with engineering.
• Lead incident response: playbooks, on-call escalation, post-incident reviews, and regulator or partner notification when required.

Leadership and culture

• Build the security roadmap and budget, and present posture and risk to the CTO, leadership and board.
• Run security awareness training and phishing simulations for all staff.
• Act as the security partner to product and engineering, enabling delivery rather than blocking it.
• Grow the function over time through hires, contractors or managed services as the business scales.

Requirements

• 8+ years in information security, with at least 3 years leading a GRC or security program.
• Hands-on experience taking a company through ISO 27001 and/or SOC 2 certification, ideally as the owner rather than a contributor.
• Solid knowledge of PCI DSS and of security expectations in regulated financial services (fintech, banking, payments).
• Working knowledge of Egyptian regulation relevant to fintech and personal data, or a proven record of quickly mapping a new regulatory regime into controls.
• Practical penetration testing background: you have run tests yourself or managed testers closely, and can read a report critically. OWASP Top 10 (web, API and mobile) is familiar ground.
• Strong infrastructure and cloud security knowledge: AWS or GCP, IAM, network segmentation, Kubernetes and containers, encryption and key management.
• Experience leading incident response from detection to post-mortem
• Clear written and spoken English and Arabic. You can explain risk to a board and argue a fix with an engineer.

Certifications (at least one expected): CISSP, CISM, CISA, CRISC, or ISO 27001 Lead Implementer/Lead Auditor.

Technical certifications (a strong plus): OSCP, CEH, or a cloud security certification (AWS Security Specialty, CCSP).

Nice to have

• Experience with Vanta, Drata or a similar compliance automation tool.
• Exposure to card-network or bank partner security assessments.
• Experience building a security function from scratch at a startup.

Benefits

• Comprehensive Wellbeing: Enjoy peace of mind with ourprivate medical insurance and life cover, plus extra days off for every year you're part of the team.
• Financial Growth: Reap the rewards of your hard work with our annual profit share and competitive compensation packages.
• Work-Life Balance: Achieve optimal well-being with our hybrid work environment, generous maternity and paternity benefits, and regular team-building events.
• Continuous Development: Expand your horizons through our commitment to learning and development opportunities.
• Perks and Privileges: Celebrate your journey with us through birthday offs, mobile allowances, transportation support, and a host of other employee-centric perks.