{"id":4230027,"url":"https://alion.io/job/mama-money-remote-information-security-lead","title":"[Remote] Information Security Lead","company":{"id":57414,"name":"Mama Money","domain":"mamamoney.co.za","url":"https://alion.io/company/mama-money","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Lever","truth_index":null},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":["United States"],"countries":["US"],"hiring_countries":["US"],"hiring_countries_total":1,"salary":null,"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"IAM","optional":false},{"name":"ISO 27001","optional":false},{"name":"Least Privilege","optional":false},{"name":"OWASP","optional":false},{"name":"Python","optional":false},{"name":"Threat Modeling","optional":false}],"status":"closed","first_seen_at":"2026-11-13T07:50:47Z","employer_posted_date":null,"last_verified_at":"2026-11-13T15:28:45Z","board_verified":false,"closed_at":"2026-11-13T15:28:45Z","days_open":0,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":0},"description":"Note: The job is a remote job and is open to candidates in USA. Mama Money is hiring an Information Security Lead to own security across the company, with a primary focus on APIs and third-party integrations. The role sets security standards, handles threat modeling and incident response, and oversees security operations, endpoint providers, and compliance.\n\nResponsibilities\nAPI and integration security: Own the security of our public and partner APIs. Set the standard for authentication, secrets handling, request signing, rate limiting and input validation\nThreat model every new partner integration before it goes live, and review existing ones\nMonitor third-party calls for anomalies and failures, and make sure we can trace what was sent where\nEdge and traffic protection: Own and manage our WAF. Write and tune its rules, manage bot and DDoS protection, and keep false positives low enough that customers aren't blocked\nSet up alerting on unusual traffic, such as spikes in volume, failed logins, unusual geographies or suspicious API usage. Investigate alerts and act on them fast\nSecure development: Work with engineering to build security into how we ship: code review, dependency and secrets scanning, and SAST/DAST in the pipeline\nRun penetration tests and own remediation until findings are closed. Third-party risk: Assess the security of partners and vendors before we connect to them, and keep that review current\nEndpoint security: Own the relationship with our outsourced provider. Set the standards, hold them to SLAs, review their reporting and close the gaps\nSecurity operations and incident response: Own monitoring and alerting, the incident response plan and tabletop exercises. Lead incidents when they happen\nCompliance: Own the security controls in our ISMS under ISO 27001. Support audits with working evidence, and keep us aligned with POPIA and FSCA, Prudential Authority and SARB cybersecurity requirements\nWork with our System Administrator on access management, least privilege and access reviews\nRun security awareness for the whole company, and keep documentation and runbooks current\n\nSkills\n6+ years in information security, with at least 3 in application, API or cloud security\nHands-on API security: OAuth 2.0 and OIDC, JWT, mTLS, request signing, and the OWASP API Security Top 10\nPractical AWS security: IAM, KMS, CloudTrail, GuardDuty, Security Hub, WAF\nExperience threat modelling systems and reviewing code for security issues\nExperience scoping penetration tests and driving remediation\nExperience leading incident response, from detection to post-mortem\nExperience managing an outsourced security provider against clear standards\nScripting in Python or Bash, enough to automate checks and pull evidence\nOne or more of: CISSP or CISM; OSCP, OSWE or GWAPT; AWS Certified Security, Specialty\nExperience in a regulated environment, ideally payments or banking; FSCA, SARB or FIC exposure is a plus\nPCI DSS experience\nISO 27001 implementation or audit experience\nSIEM and detection engineering\nKubernetes and container security\nTerraform or other infrastructure-as-code\n\nCompany Overview\nMama Money is the world’s first social business for remittances. It was founded in 2013, and is headquartered in Cape Town, NA - South Africa, ZAF, with a workforce of 51-200 employees. Its website is https://www.mamamoney.co.za/.","description_format":"text","description_chars":3363,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Money Transfer & Remittances"],"lifecycle":[{"event":"open","at":"2026-11-13T09:21:30Z"},{"event":"close","at":"2026-11-13T15:28:45Z"}],"visa":[],"liveness":null,"pay":null,"html_url":"https://alion.io/job/mama-money-remote-information-security-lead","json_url":"https://alion.io/job/mama-money-remote-information-security-lead.json","meta":{"generated_at":"2026-11-14T02:54:08Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":4100,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-15T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":57414},"rest":"https://alion.io/mcp/rest/get_company?id=57414"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fmama-money-remote-information-security-lead"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"free","price":{"credits":0,"usd":0},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fmama-money-remote-information-security-lead"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fmama-money-remote-information-security-lead"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/mama-money-remote-information-security-lead\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fmama-money-remote-information-security-lead"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4230027}},{"tool":"search_jobs","arguments":{"company":"mamamoney.co.za","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4230027},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}