IT Security Engineer

Mal; Abu Dhabi; On-site; AED 300,000 - 540,000; Full time

Job summary

Mal seeks an IT Security Engineer to own the endpoint-to-identity security stack, automating MDM, EDR, IdP, email security, and DLP. You’ll implement passwordless workflows, CI/CD security, and policy-driven controls across Google Workspace and SaaS apps.

As a hands-on engineer, you’ll drive secure by design practices, collaborate with GRC and DevSecOps, and advance a modern, AI-enabled banking security posture.

Qualifications

• 4+ years in an IT Security, Corporate Security Engineering, or IT Infrastructure role with hands-on security tooling ownership.
• Direct hands-on experience with MDM platforms (Jamf/Intune) including enrollment and compliance policy design.
• Direct hands-on experience with an EDR platform (Checkpoint/CrowdStrike/Microsoft Defender).
• Direct hands-on experience administering Okta with SSO, conditional access, and lifecycle automation.
• Experience administering Google Workspace at the security/admin level, or Microsoft 365.
• Experience implementing DLP controls across email, endpoint, or SaaS.
• Experience administering an enterprise password manager (1Password/Bitwarden).
• Strong scripting/automation ability (Python) with API-based automation.
• Ability to work across GRC, DevOps, and IAM stakeholders.
• Comfortable operating in a regulated financial services or fintech environment.

Responsibilities

• Design, deploy, and operate MDM across the fleet with enrollment and policy baselines.
• Own EDR tooling setup, tuning, and response workflows.
• Own IdP architecture (Okta) with SSO, CA, MFA/passwordless, and JML automation.
• Design and operate Secure Email Gateway controls and DMARC/DKIM/SPF posture.
• Implement DLP controls across email, endpoints, and SaaS.
• Manage enterprise password manager vaults and lifecycle.
• Build IAM automation across provisioning/deprovisioning and access reviews.
• Automate IT security operations and explore AI agent automation for routine tasks.
• Collaborate with GRC on controls mapping and audit readiness.
• Partner with DevSecOps to align IAM boundaries across domains.

Skills

Security tooling

MDM Jamf/Intune

EDR tooling

Okta SSO/CA automation

GWS security admin

DLP controls

Password manager

Scripting Python

Stakeholder collaboration

Regulatory environment

Education

Jamf Certified Expert

Microsoft Certified: Endpoint Administrator

Okta Certified Professional

Tools

Jamf

Intune

Okta

Checkpoint Harmony

CrowdStrike

Microsoft Defender

Google Workspace

1Password

Job description

About the Role:

At Mal, we are pioneering the world's first Sharia-compliant, AI-powered digital bank, delivering ethical financial services for Muslims worldwide. As we scale, we recognize the foundational importance of securing every endpoint, identity, and mailbox—before our team even accesses production systems. Our commitment to automation and security-by-design means every layer, from device posture to identity management, must be robust, integrated, and scalable.

As an IT Security Engineer, you will own and evolve Mal’s endpoint-to-identity security layer. You’ll architect, implement, and automate solutions across MDM, EDR, identity and access, email security, DLP, and credential management. Your mission: ensure every device and user at Mal is protected with minimal manual overhead, championing a "security as code" philosophy that aligns with our AI-first, modern banking vision.

Key Responsibilities:

• Design, deploy, and operate Mobile Device Management (MDM) across the fleet (Jamf for macOS/iOS, Intune for Windows/Android), including enrollment, compliance policies, and configuration baselines


• Own Endpoint Detection and Response (EDR) tooling (e.g. Checkpoint Harmony or equivalent) — deployment, detection tuning, and response workflows


• Own workforce Identity Provider (IdP) architecture (Okta), including SSO, conditional access, MFA/passwordless enrollment, and lifecycle (JML) automation, integrated with Google Workspace (GWS) as the core productivity identity


• Design and operate Secure Email Gateway (SEG) controls — phishing/malware filtering, DMARC/DKIM/SPF posture, and email-borne threat response


• Design and operate Data Loss Prevention (DLP) controls across email, endpoints, and SaaS, calibrated to Mal’s data classification requirements


• Own the enterprise password manager (1Password or equivalent) — vault architecture, sharing policies, and credential lifecycle for both individual and shared/service credentials


• Build workforce IAM automation across the full stack above — provisioning, deprovisioning, access reviews, and entitlement management — treating identity as the connective tissue between every tool


• Automate IT security operations by default: script and integrate rather than click through consoles, and evaluate where AI agents can take on routine detection triage, ticket handling, or access-review workflows


• Partner with GRC on control evidence, audit readiness, and mapping IT security controls to regulatory requirements (CBUAE, ISO 27001, SOC 2)


• Partner with DevSecOps/SRE on the workforce-to-infrastructure identity boundary, keeping IAM patterns consistent across both domains

Must-Have Qualifications:

• 4+ years in an IT Security, Corporate Security Engineering, or IT Infrastructure role with direct hands-on ownership of security tooling (not policy-only)


• Direct hands-on experience with an MDM platform — Jamf and/or Intune — including enrollment and compliance policy design


• Direct hands-on experience with an EDR platform (Checkpoint or comparable — e.g. CrowdStrike, SentinelOne, Microsoft Defender)


• Direct hands-on experience administering Okta or a comparable IdP, including SSO, conditional access, and lifecycle automation


• Experience administering Google Workspace (GWS) at the security/admin level, or a comparable productivity suite (Microsoft 365)


• Experience implementing DLP controls across email, endpoint, or SaaS


• Experience administering an enterprise password manager (1Password or comparable — e.g. Bitwarden)


• Strong scripting/automation ability (Python, or equivalent) with real experience automating IT security workflows via API rather than manual console work


• Demonstrated ability to work across GRC, DevOps, and IAM stakeholders without needing every requirement handed to you pre-translated


• Comfortable operating in a regulated environment (financial services, fintech, or similarly compliance-heavy sector)

Nice to Have:

• Experience designing or operating a Secure Email Gateway (SEG) beyond native Google/Microsoft filtering


• Experience with IT security automation via low-code/workflow tools (e.g. Tines, Torq) or custom integration frameworks


• Direct experience evaluating or deploying AI agents/LLM-based automation for IT operations or security triage


• Experience in a bank, fintech, or ADGM/CBUAE-regulated environment


• Familiarity with SOC 2, ISO 27001:2022, or CBUAE technology-risk control requirements as they apply to endpoint and identity


• Experience building Zero Trust device-trust conditional access (e.g. Okta + device posture signals)


• Relevant certifications: Jamf Certified Expert, Microsoft Certified: Endpoint Administrator, Okta Certified Professional


• Experience with vendor/SaaS security triage for new tool onboarding (shadow IT reduction)

First 60 Days:

• Complete an assessment of current MDM enrollment coverage and compliance policy gaps across the fleet


• Stand up or harden EDR coverage with a first pass of tuned detections and a documented response workflow


• Audit Okta conditional access and lifecycle automation for at least one critical user population, closing the highest-priority gaps


• Ship the first automated (non-console) workflow for a recurring IT security task — e.g. access review, JML step, or DLP alert triage


• Deliver a short options paper on where AI-agent automation could take over a specific routine IT security task


• Establish a working cadence with GRC for control evidence and with DevOps/SRE on the IAM boundary