Information Security Lead

Who we are:

Mama Money is a growth-stage fintech on a mission to improve the financial lives of migrants and underserved communities across Africa and beyond. What started in 2015 as a cross-border payments service has grown into a multi-product financial platform - giving people the tools to send, save, and manage money on their own terms, at a socially fair price. Payments were just the beginning; today Mama Money is building the fuller financial toolkit our customers need, all under one roof.

Mama HQ is in beautiful Cape Town. We're 157 people strong (and counting), representing 19 countries across Africa, Asia, the UK, and Europe. Everything we build is in service of people who deserve better - and our culture reflects that same commitment. We've had good times and tough times, but the focus never shifts: people over profit, always.

The role, in short:

You'll own security at Mama Money end to end. Your main focus is our APIs and the third-party calls our products depend on: payout partners, banks, card and KYC providers. Endpoints come second, but they matter too.

This is a lead role, not a management layer. You'll set the standards and make the calls, and you'll also do the work: threat modelling, reviewing code and integrations, running incidents. Endpoint security is managed day to day by our outsourced provider. You'll work with them directly, but the accountability for security sits with you.

A big part of the role is explaining risk clearly to engineers, leadership and regulators, so clear writing matters as much as technical depth.

After-hours: you'll be the escalation point for security incidents.

What you'll actually be doing:

• API and integration security: Own the security of our public and partner APIs. Set the standard for authentication, secrets handling, request signing, rate limiting and input validation.
• Threat model every new partner integration before it goes live, and review existing ones.
• Monitor third-party calls for anomalies and failures, and make sure we can trace what was sent where.
• Edge and traffic protection: Own and manage our WAF. Write and tune its rules, manage bot and DDoS protection, and keep false positives low enough that customers aren't blocked.
• Set up alerting on unusual traffic, such as spikes in volume, failed logins, unusual geographies or suspicious API usage. Investigate alerts and act on them fast.
• Secure development: Work with engineering to build security into how we ship: code review, dependency and secrets scanning, and SAST/DAST in the pipeline.
• Run penetration tests and own remediation until findings are closed. Third-party risk: Assess the security of partners and vendors before we connect to them, and keep that review current.
• Endpoint security: Own the relationship with our outsourced provider. Set the standards, hold them to SLAs, review their reporting and close the gaps.
• Security operations and incident response: Own monitoring and alerting, the incident response plan and tabletop exercises. Lead incidents when they happen.
• Compliance: Own the security controls in our ISMS under ISO 27001. Support audits with working evidence, and keep us aligned with POPIA and FSCA, Prudential Authority and SARB cybersecurity requirements.
• Work with our System Administrator on access management, least privilege and access reviews.
• Run security awareness for the whole company, and keep documentation and runbooks current.

What we're looking for:

• 6+ years in information security, with at least 3 in application, API or cloud security.
• Hands-on API security: OAuth 2.0 and OIDC, JWT, mTLS, request signing, and the OWASP API Security Top 10.
• Practical AWS security: IAM, KMS, CloudTrail, GuardDuty, Security Hub, WAF.
• Experience threat modelling systems and reviewing code for security issues.
• Experience scoping penetration tests and driving remediation.
• Experience leading incident response, from detection to post-mortem.
• Experience managing an outsourced security provider against clear standards.
• Scripting in Python or Bash, enough to automate checks and pull evidence.
• One or more of: CISSP or CISM; OSCP, OSWE or GWAPT; AWS Certified Security, Specialty.

Nice to have:

• Experience in a regulated environment, ideally payments or banking; FSCA, SARB or FIC exposure is a plus.
• PCI DSS experience.
• ISO 27001 implementation or audit experience.
• SIEM and detection engineering.
• Kubernetes and container security.
• Terraform or other infrastructure-as-code.