Information Security Lead

Job not on LinkedIn

🔥 2 hours ago

🇿🇦 South Africa – Remote

⏰ Full Time

🟠 Senior

👮‍♂️ Cybersecurity / Security Engineer

👻 Ghost score 12%

What it means: the chance that no one is really hiring for this job.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.Why this score:

• Just posted.
• No salary listed.

Apply Now

Find Similar Remote Jobs

Mama Money

WebsiteLinkedInAll Job Openings

51 - 200 employees

💸 Finance

💳 Fintech

👥 B2C

Finance • Fintech • B2C

Mama Money is an international money transfer service based in South Africa. It provides a simple, safe, and affordable way for people to send money to over 70 countries across Africa, Asia, and Europe. Users can utilize the Mama Money mobile app or USSD service to send money, ensuring convenience and accessibility. The service is designed to offer competitive rates and transparent pricing without hidden charges, prioritizing safety and security for all transactions. Registration is user-friendly, requiring only relevant identification documents, and the app is available for free on major platforms.

📋 Description

• Own security at Mama Money end to end, with primary focus on APIs and third-party calls to payout partners, banks, card and KYC providers. • Set security standards and make security decisions while performing threat modelling, code and integration reviews, and incident management. • Explain risk clearly to engineers, leadership and regulators. • Own security of public and partner APIs, including authentication, secrets handling, request signing, rate limiting and input validation. • Threat model new partner integrations and review existing integrations. • Monitor third-party calls for anomalies and failures and ensure traceability. • Manage WAF rules, bot and DDoS protection, and false positives. • Set alerting for unusual traffic and investigate alerts. • Build security into engineering delivery through code review, dependency and secrets scanning, and SAST/DAST. • Run penetration tests and own remediation. • Assess and monitor partner and vendor security. • Manage the outsourced endpoint security provider, standards, SLAs and reporting. • Own security monitoring, alerting, incident response plans and tabletop exercises; lead incidents. • Own ISMS security controls under ISO 27001 and support audits with evidence. • Maintain alignment with POPIA, FSCA, Prudential Authority and SARB cybersecurity requirements. • Work with the System Administrator on access management, least privilege and access reviews. • Run company-wide security awareness and maintain documentation and runbooks. • Serve as the after-hours escalation point for security incidents.

🎯 Requirements

• 6+ years in information security, with at least 3 in application, API or cloud security. • Hands-on API security: OAuth 2.0 and OIDC, JWT, mTLS, request signing, and the OWASP API Security Top 10. • Practical AWS security: IAM, KMS, CloudTrail, GuardDuty, Security Hub, WAF. • Experience threat modelling systems and reviewing code for security issues. • Experience scoping penetration tests and driving remediation. • Experience leading incident response, from detection to post-mortem. • Experience managing an outsourced security provider against clear standards. • Scripting in Python or Bash, enough to automate checks and pull evidence. • One or more of: CISSP or CISM; OSCP, OSWE or GWAPT; AWS Certified Security, Specialty.

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume