Information Security Lead (Defensive)

Мы - международная группа компаний, работающая на стыке fintech, blockchain и iGaming. Разрабатываем собственные технологические продукты и решения для глобальных рынков, включая платежную инфраструктуру, аналитические системы и игровые платформы.

Компания активно инвестирует в перспективные проекты в сфере цифровых финансов и крипто-технологий, а также создает и масштабирует продукты для индустрии iGaming, предоставляя их международным клиентам.

У нас сильная техническая команда и продуктовый подход, строим собственные решения с нуля. Более 10 лет на рынке, работаем глобально и продолжаем активно расти.

Гарантируем будущему коллеге:

• Конкурентную заработную плату;

• Постоянную индексацию заработной платы;

• Корпоративную технику, современное зарубежное ПО;

• Потрясающий офис в Москва-Сити;

• Среду, свободную от бюрократии;

• Офисный формат работы 5/2 с 09:00 до 18:00 или с 10:00 до 19:00

• Работу в амбициозной команде и стремительное профессиональное развитие.

Чем предстоит заниматься:

• Поддерживать и развивать существующую инфраструктуру информационной безопасности;

• Администрировать серверы и сервисы безопасности, настраивать их взаимодействие;

• Настраивать туннели и прокси-серверы для обеспечения безопасного доступа и фильтрации трафика;

• Обеспечивать работоспособность и безопасность инфраструктуры в зарубежных офисах компании;

• Управлять ключами и сертификатами, обеспечивать безопасный обмен данными;

• Контролировать доступ и ограничивать действия пользователей;

• Сопровождать и развивать системы информационной безопасности, участвовать в аудитах и внедрять улучшения;

Мы ожидаем от кандидата:

• Опыт работы в сетевой или инфраструктурной информационной безопасности в штате от 4 лет;

• Опыт харденинга операционных систем и сетевого оборудования;

• Опыт работы со сканерами уязвимости, внутренними доменами;

• Умение писать групповые политики и проводить аудиты;

• Владение каким-либо языком программирования;

• Практические навыки администрирования Linux/Unix‑систем (готовые образы) и домена Windows;

• Высшее техническое образование (преимуществом будет в области ИТ или ИБ);
  

• Будет преимуществом:

• Опыт работы в правоохранительных органах по компьютерной/ИБ тематике (ФСБ - ЦИБ, 8 Центр, 16 Центр; МВД - БСТМ, УБК; МинОбороны - киберподразделения ГРУ);

• Уровень английского языка от В2.

About the role

Responsibilities

• Maintain and update the information security governance framework documentation, policy library, and associated standards and procedures.
• Draft and revise information security policies, standards, and baselines, ensuring alignment with applicable regulatory requirements and business objectives.
• Monitor and track changes in legal, regulatory, and contractual requirements affecting information security (SAMA CSF, PDPL, NCA ECC, PCI-DSS), updating the compliance register accordingly.
• Maintain and update role and responsibility matrices (RACI), information security governance committee documentation, and reporting packs.
• Coordinate security governance committee meetings — preparing agendas, minutes, and action tracking.
• Produce internal and external communication materials related to information security governance, policies, and programme updates.

• Execute information security risk assessments independently, applying the organization's risk assessment methodology and producing complete risk registers with identified threats, vulnerabilities, likelihood, impact, and treatment plans.
• Maintain and update the information asset register — tracking asset owners, classifications, and associated risk profiles.
• Lead business impact assessment (BIA) data collection activities, coordinating with asset owners and business units to capture accurate recovery objectives and criticality ratings.
• Conduct control effectiveness evaluations for key information security controls, documenting findings and escalating gaps to the Lead for treatment.
• Coordinate third-party information security risk assessments — preparing assessment questionnaires, reviewing vendor responses, and producing risk summaries.
• Integrate risk and vulnerability data into procurement reviews, project onboarding, and change management processes.
• Prepare periodic risk reports for senior review, highlighting emerging risks, significant changes in the risk profile, and the status of risk treatment actions.

• Monitor the organization's compliance posture against SAMA CSF, NCA ECC, PDPL, ISO 27001, and PCI-DSS — tracking control status, identifying gaps, and coordinating remediation.
• Coordinate internal and external audit activities — gathering evidence packages, liaising with auditors, tracking findings, and monitoring remediation progress.
• Support the preparation of regulatory submissions, self-assessments, and compliance attestations required by SAMA, NCA, and PCI Council.
• Maintain and enhance the security awareness programme — developing training materials, scheduling communications, and tracking completion metrics.
• Monitor KPIs and KRIs for the information security programme, preparing accurate and timely dashboards for senior management review.
• Support the integration of information security requirements into procurement, project management, and change control processes.

• Maintain the information security policy, standard, and procedure library — managing version control, review cycles, and distribution.
• Support information security initiatives across business and technology teams, providing GRC subject matter expertise on projects and change programmes.
• Conduct information classification reviews and document security requirements for key business and IT projects.
• Deliver information security awareness sessions and materials to targeted staff groups.
• Provide analytical support for GRC team reporting, data gathering, and programme tracking activities.

Qualifications

• Bachelor's degree in Information Technology, Computer Science, Software Engineering, Cybersecurity, Risk Management, or a related field.
• 1–3 years of professional experience in information security governance, risk management, compliance, or a closely related field. Hands-on experience with risk assessment execution, policy development, or compliance monitoring is required. Prior exposure to SAMA CSF, ISO 27001, PDPL, or NCA ECC requirements is a strong advantage. Experience in a regulated Fintech or banking environment is preferred.
• ISO 27001 Foundation or Lead Implementer (preferred). CompTIA Security+ or equivalent. 
• Working toward CRISC (Certified in Risk and Information Systems Control) or CISM.

Benefits

• We are an international team of inspired professionals located all over the globe.
• We  have an inclusive company culture, embracing diversity, integrity and transparency. We strive for work-life balance and cherish the moments you spend with your loved ones, off-work. In the same spirit as for our product, we are caring and nurturing for our employees.
• Our people are granted 100% trust and freedom to apply their own vision and come up with their ideas from day 1 at Tabby. You are the one who takes responsibility for your area of work. We encourage everyone to think and make decisions like Tabby was their own business, well because it is. Our employee stock options programme is available for everyone. 
• You will have an opportunity to learn and grow in one of the fastest growing fin tech companies in the region
• We offer you relocation support as well as we guide you through all the process.
• We’ll set you up with the devices required for your work.

About the role

Responsibilities

• Lead and contribute hands-on to security architecture and technical security reviews across cloud, infrastructure and product initiatives.
•  Design and implement security controls across GCP and AWS, including IAM, CSPM and cloud-native security. 
•  Drive and contribute to Secure SDLC / DevSecOps, including SAST, DAST, SCA and container security. 
•  Lead vulnerability management and actively participate in penetration testing, VAPT and red/purple team engagements. 
•  Design and improve threat detection, SIEM use cases and security monitoring. 
•  Lead and participate in complex security incident investigations and response. 
•  Drive endpoint, infrastructure, network and firewall security initiatives. 
•  Automate security processes and develop security tooling where needed. 
•  Establish technical standards, security best practices and operating procedures. 
•  Manage, mentor and develop a team of security engineers and analysts. 
•  Work closely with Engineering, Infrastructure, Product, IT, Legal and Compliance teams to embed security across Tabby.

Qualifications

• Strong experience leading Information Security / Cyber Security functions in a senior technical or management role.
• 5+ years of experience in Information Security or Cybersecurity, with at least 2 years in a technical leadership or senior individual contributor role. Prior people management or team leadership experience is strongly preferred.
•  Deep expertise across Cloud Security, Security Architecture, VAPT, AppSec/DevSecOps and Defensive Security. 
•  Experience leading security programmes and managing cross-functional initiatives. 
•  Strong knowledge of GCP/AWS, IAM, CSPM, SIEM, EDR/XDR and vulnerability management. 
•  Strong understanding of penetration testing, red/purple teaming, threat hunting and incident response. 
•  Experience with SAST, DAST, SCA and container security within CI/CD environments. 
•  Strong understanding of security architecture, threat modelling and enterprise security controls. 
•  Experience working within a regulated FinTech or banking environment. 
•  Knowledge of CBUAE, UAE PDPL, PCI-DSS, ISO 27001 and SOC 2. 
•  Proven people leadership, stakeholder management and strategic decision-making skills. 
• CISSP/CISM and OSCP or equivalent certifications are preferred/required depending on the final hiring criteria.