[Remote] Information Security Lead

Note: The job is a remote job and is open to candidates in USA. Mama Money is hiring an Information Security Lead to own security across the company, with a primary focus on APIs and third-party integrations. The role sets security standards, handles threat modeling and incident response, and oversees security operations, endpoint providers, and compliance.

Responsibilities

• API and integration security: Own the security of our public and partner APIs. Set the standard for authentication, secrets handling, request signing, rate limiting and input validation
• Threat model every new partner integration before it goes live, and review existing ones
• Monitor third-party calls for anomalies and failures, and make sure we can trace what was sent where
• Edge and traffic protection: Own and manage our WAF. Write and tune its rules, manage bot and DDoS protection, and keep false positives low enough that customers aren't blocked
• Set up alerting on unusual traffic, such as spikes in volume, failed logins, unusual geographies or suspicious API usage. Investigate alerts and act on them fast
• Secure development: Work with engineering to build security into how we ship: code review, dependency and secrets scanning, and SAST/DAST in the pipeline
• Run penetration tests and own remediation until findings are closed. Third-party risk: Assess the security of partners and vendors before we connect to them, and keep that review current
• Endpoint security: Own the relationship with our outsourced provider. Set the standards, hold them to SLAs, review their reporting and close the gaps
• Security operations and incident response: Own monitoring and alerting, the incident response plan and tabletop exercises. Lead incidents when they happen
• Compliance: Own the security controls in our ISMS under ISO 27001. Support audits with working evidence, and keep us aligned with POPIA and FSCA, Prudential Authority and SARB cybersecurity requirements
• Work with our System Administrator on access management, least privilege and access reviews
• Run security awareness for the whole company, and keep documentation and runbooks current

Skills

• 6+ years in information security, with at least 3 in application, API or cloud security
• Hands-on API security: OAuth 2.0 and OIDC, JWT, mTLS, request signing, and the OWASP API Security Top 10
• Practical AWS security: IAM, KMS, CloudTrail, GuardDuty, Security Hub, WAF
• Experience threat modelling systems and reviewing code for security issues
• Experience scoping penetration tests and driving remediation
• Experience leading incident response, from detection to post-mortem
• Experience managing an outsourced security provider against clear standards
• Scripting in Python or Bash, enough to automate checks and pull evidence
• One or more of: CISSP or CISM; OSCP, OSWE or GWAPT; AWS Certified Security, Specialty
• Experience in a regulated environment, ideally payments or banking; FSCA, SARB or FIC exposure is a plus
• PCI DSS experience
• ISO 27001 implementation or audit experience
• SIEM and detection engineering
• Kubernetes and container security
• Terraform or other infrastructure-as-code

Company Overview