About the Role

erad is a Sharia-compliant fintech providing SME financing in Saudi Arabia and the UAE, licensed by the CMA in KSA and the DFSA in the UAE. We are hiring a Cybersecurity Engineer to own the security of our platform, our people and our devices. You will report to the CTO and work with a fully distributed engineering team that ships with AI-assisted tooling every day. We especially want to hear from penetration testers and security auditors who are ready to move from finding the issues to owning the fixes.

What You'll Do

Security engineering and testing

Own the security posture of our cloud environment: identity and access, network exposure, host hardening and patching, secrets, and logging coverage.
Test our own products the way an attacker would: regular internal pentests of our web apps and APIs, plus scoping and retests with external testers.
Build and run vulnerability management across code, dependencies, hosts and third-party software, with remediation SLAs tracked to closure.
Review designs and pull requests with engineers, and build security into our delivery pipeline.

Detection and response

Own security alerting and keep it useful rather than noisy.
Lead incident response end to end: triage, containment, investigation, root cause and the write-up for management and regulators.
Run phishing awareness, tabletop exercises and restore tests.

Governance and compliance

Run our ISMS: control evidence, risk register, policies, vendor security reviews, access reviews and audit support.
Turn regulatory requirements (CMA, DFSA, and KSA and UAE data protection law) into practical controls and evidence.

IT (around 20% of your time)

Run joiner, mover and leaver access: accounts, SSO, app roles, offboarding and data handover.
Manage company laptops through MDM: enrolment, configuration, encryption and app deployment.
Administer our identity and collaboration tools, the company password manager and MFA.
Automate the repetitive parts so IT stays a small slice of the job.

Qualifications & Experience

3+ years in security, ideally including time as a penetration tester or security auditor at a pentest firm, security consultancy or compliance platform.
Hands-on web application, API and cloud penetration testing: you can find and exploit real vulnerabilities, write them up clearly, and work with engineers on the fix.
Practical security experience on at least one major cloud provider: IAM, network controls and logging.
Experience with WAF and zero-trust access tooling.
Strong Linux and networking fundamentals: SSH, TLS, DNS, firewalls and VPNs.
Comfortable writing automation in Python or Bash, and reviewing application code for security issues (OWASP Top 10).
Incident response experience, including investigating from raw logs.
Familiarity with ISO 27001 or SOC 2 controls and producing audit evidence.
Some experience administering an identity provider and managing devices with an MDM.
Uses AI tools to work faster and checks their output critically.
Fluent English, written and spoken.

Skills (Nice-to-Haves)

Experience in fintech, banking or other regulated financial services, ideally with GCC regulators.
Certifications such as OSCP, OSWE, CREST, CISSP, CCSP, a cloud provider security certification, or ISO 27001 Lead Implementer or Lead Auditor.
Container security, infrastructure as code and CI/CD security.
Knowledge of the Saudi and UAE personal data protection laws.
Red-team experience, published CVEs, bug bounty findings or CTF results.
Experience as the first or only security engineer at a startup.
Arabic is a plus.

erad

Latest Jobs

Cybersecurity Engineer (Cloud & IT) - Remote