{"id":4031261,"url":"https://alion.io/job/mama-money-information-security-lead","title":"Information Security Lead","company":{"id":57414,"name":"Mama Money","domain":"mamamoney.co.za","url":"https://alion.io/company/mama-money","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Lever","truth_index":null},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":[],"countries":[],"hiring_countries":["ZA"],"hiring_countries_total":1,"salary":null,"salary_estimate":null,"experience_years_min":6,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"IAM","optional":false},{"name":"ISO 27001","optional":false},{"name":"Least Privilege","optional":false},{"name":"OWASP","optional":false},{"name":"Python","optional":false},{"name":"Kubernetes","optional":true},{"name":"PCI DSS","optional":true},{"name":"SIEM","optional":true},{"name":"Terraform","optional":true}],"status":"live","first_seen_at":"2026-11-10T16:08:31Z","employer_posted_date":"2026-11-10","last_verified_at":"2026-11-12T12:30:04Z","board_verified":true,"closed_at":null,"days_open":1,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":1},"description":"Who we are:\nMama Money is a growth-stage fintech on a mission to improve the financial lives of migrants and underserved communities across Africa and beyond. What started in 2015 as a cross-border payments service has grown into a multi-product financial platform - giving people the tools to send, save, and manage money on their own terms, at a socially fair price. Payments were just the beginning; today Mama Money is building the fuller financial toolkit our customers need, all under one roof.\nMama HQ is in beautiful Cape Town. We're 157 people strong (and counting), representing 19 countries across Africa, Asia, the UK, and Europe. Everything we build is in service of people who deserve better - and our culture reflects that same commitment. We've had good times and tough times, but the focus never shifts: people over profit, always.\nThe role, in short:\nYou'll own security at Mama Money end to end. Your main focus is our APIs and the third-party calls our products depend on: payout partners, banks, card and KYC providers. Endpoints come second, but they matter too.\nThis is a lead role, not a management layer. You'll set the standards and make the calls, and you'll also do the work: threat modelling, reviewing code and integrations, running incidents. Endpoint security is managed day to day by our outsourced provider. You'll work with them directly, but the accountability for security sits with you.\nA big part of the role is explaining risk clearly to engineers, leadership and regulators, so clear writing matters as much as technical depth.\nAfter-hours: you'll be the escalation point for security incidents.\nWhat you'll actually be doing:\nAPI and integration security: Own the security of our public and partner APIs. Set the standard for authentication, secrets handling, request signing, rate limiting and input validation.\nThreat model every new partner integration before it goes live, and review existing ones.\nMonitor third-party calls for anomalies and failures, and make sure we can trace what was sent where. \nEdge and traffic protection: Own and manage our WAF. Write and tune its rules, manage bot and DDoS protection, and keep false positives low enough that customers aren't blocked. \nSet up alerting on unusual traffic, such as spikes in volume, failed logins, unusual geographies or suspicious API usage. Investigate alerts and act on them fast. \nSecure development: Work with engineering to build security into how we ship: code review, dependency and secrets scanning, and SAST/DAST in the pipeline. \nRun penetration tests and own remediation until findings are closed. Third-party risk: Assess the security of partners and vendors before we connect to them, and keep that review current. \nEndpoint security: Own the relationship with our outsourced provider. Set the standards, hold them to SLAs, review their reporting and close the gaps. \nSecurity operations and incident response: Own monitoring and alerting, the incident response plan and tabletop exercises. Lead incidents when they happen. \nCompliance: Own the security controls in our ISMS under ISO 27001. Support audits with working evidence, and keep us aligned with POPIA and FSCA, Prudential Authority and SARB cybersecurity requirements. \nWork with our System Administrator on access management, least privilege and access reviews. \nRun security awareness for the whole company, and keep documentation and runbooks current.\nWhat we're looking for:\n6+ years in information security, with at least 3 in application, API or cloud security.\nHands-on API security: OAuth 2.0 and OIDC, JWT, mTLS, request signing, and the OWASP API Security Top 10.\nPractical AWS security: IAM, KMS, CloudTrail, GuardDuty, Security Hub, WAF. \nExperience threat modelling systems and reviewing code for security issues.\nExperience scoping penetration tests and driving remediation.\nExperience leading incident response, from detection to post-mortem.\nExperience managing an outsourced security provider against clear standards.\nScripting in Python or Bash, enough to automate checks and pull evidence.\nOne or more of: CISSP or CISM; OSCP, OSWE or GWAPT; AWS Certified Security, Specialty.\nNice to have:\nExperience in a regulated environment, ideally payments or banking; FSCA, SARB or FIC exposure is a plus.\nPCI DSS experience.\nISO 27001 implementation or audit experience.\nSIEM and detection engineering.\nKubernetes and container security.\nTerraform or other infrastructure-as-code.","description_format":"text","description_chars":4471,"description_truncated":false,"requirements":{"experience_years_min":6,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"South Africa","iso":"ZA","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Money Transfer & Remittances"],"lifecycle":[{"event":"open","at":"2026-11-10T18:42:36Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":1,"expected_fill_days":90,"reasons":["conf:3","win:early"],"computed_at":"2026-11-12T10:38:37Z"},"pay":null,"html_url":"https://alion.io/job/mama-money-information-security-lead","json_url":"https://alion.io/job/mama-money-information-security-lead.json","meta":{"generated_at":"2026-11-12T15:00:13Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"assistant_verified","counted_by":"address","units_charged":1,"used_today":3896,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-13T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":57414},"rest":"https://alion.io/mcp/rest/get_company?id=57414"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fmama-money-information-security-lead"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fmama-money-information-security-lead"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fmama-money-information-security-lead"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/mama-money-information-security-lead\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fmama-money-information-security-lead"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4031261}},{"tool":"search_jobs","arguments":{"company":"mamamoney.co.za","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4031261},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}