Information Security Lead

This is a fully remote position, open to applicants in South Africa.

📋 Description

• Take full ownership of security at Mama Money, focusing primarily on APIs and interactions with third-party payout partners, banks, card providers, and KYC services.

• Establish security standards and make informed security decisions through threat modeling, code and integration assessments, and incident management.

• Clearly articulate risks to engineers, leadership, and regulatory bodies.

• Manage the security of public and partner APIs, encompassing authentication, secret management, request signing, rate limiting, and input validation.

• Conduct threat modeling for new partner integrations and evaluate existing ones.

• Monitor third-party calls to detect anomalies and failures, ensuring traceability.

• Oversee WAF rules, bot and DDoS protection, and address false positives.

• Set up alerts for unusual traffic patterns and investigate any alerts generated.

• Integrate security practices into the engineering delivery process via code reviews, dependency and secret scanning, and SAST/DAST methodologies.

• Perform penetration testing and manage the remediation efforts.

• Evaluate and monitor the security posture of partners and vendors.

• Oversee the outsourced endpoint security provider, including standards, SLAs, and reporting requirements.

• Manage security monitoring, alerting, incident response plans, and conduct tabletop exercises; take the lead during incidents.

• Handle ISMS security controls in accordance with ISO 27001 and assist with audits by providing evidence.

• Ensure compliance with POPIA, FSCA, Prudential Authority, and SARB cybersecurity standards.

• Collaborate with the System Administrator on access management, maintaining the principle of least privilege and conducting access reviews.

• Facilitate company-wide security awareness initiatives, and maintain relevant documentation and runbooks.

• Act as the escalation point for security incidents during after-hours situations.

⛳️ Requirements

• A minimum of 6 years of experience in information security, with at least 3 years dedicated to application, API, or cloud security.

• Proficient in API security practices including OAuth 2.0, OIDC, JWT, mTLS, request signing, and the OWASP API Security Top 10.

• Knowledgeable in AWS security measures such as IAM, KMS, CloudTrail, GuardDuty, Security Hub, and WAF.

• Experience in threat modeling systems and assessing code for security vulnerabilities.

• Proven track record in scoping penetration tests and overseeing remediation processes.

• Experience leading incident response efforts from detection through to post-mortem analysis.

• Skilled in managing an outsourced security provider against established standards.

• Proficient in scripting with Python or Bash to automate checks and gather evidence.

• Hold one or more certifications: CISSP or CISM; OSCP, OSWE, or GWAPT; AWS Certified Security, Specialty.

🏝️ Benefits

• Competitive salary package.

• Opportunities for professional development and career advancement.

• Flexible working hours and remote work options.

• Inclusive and diverse work environment.