Security Lead

Bamboo Card LLC; Dubai; On-site; AED 350,000 - 600,000; Full time

Benefits offered by this job

Health insurance

Visa sponsorship

Job summary

Bamboo Card LLC in Dubai is seeking a hands-on Security Lead to own platform security end to end. You will set strategy, review architecture, read code, and harden systems across infrastructure, applications, and data.

You will protect B2B/B2C portals and partner APIs, manage IAM, secure AWS, and embed security into CI/CD. The role requires extensive incident response and governance experience in a fast-growing fintech environment.

Qualifications

• 10+ years in information security with at least 3 years in a lead role.
• Hands-on experience securing production AWS environments.
• Strong web app and API security: OAuth2/OIDC, mTLS, API gateways, WAF, rate limiting, bot protection.
• Experience protecting systems handling sensitive or financial data, incl. fraud and account takeover.
• Real incident response experience beyond runbooks.
• Comfort reading code and reviewing architecture; .NET, SQL Server, or GitHub Actions a plus.
• Knowledge of GDPR, UAE PDPL, ISO 27001, SOC 2, NIST, or CIS.

Responsibilities

• Own security roadmap across infrastructure, applications, APIs, and data; report posture to CTO/leadership.
• Define and maintain security policies, standards, and a living risk register.
• Grow security function with tooling, processes, and future hires.
• Protect portals and partner APIs against OWASP Top 10, API abuse, bots, and fraud patterns.
• Own identity and access security: Cognito/SSO/MFA, session management, account takeover protection.
• Harden AWS: IAM, network segmentation, KMS, WAF, Shield, GuardDuty, Security Hub, CloudTrail; enforce least privilege.
• Integrate security into CI/CD and train engineers on secure coding.
• Lead incident response; run vulnerability management and coordinate external pentests.
• Drive GDPR/UAE PDPL compliance and progress toward ISO 27001 / SOC 2.
• Communicate risk clearly to engineers, executives, and clients; influence teams.

Skills

Cybersecurity leadership

Cloud security

Application security

Identity & access management

Threat modelling

Incident response

Secure coding practices

Vulnerability management

DevSecOps

Security architecture

Tools

AWS

GitHub Actions

WAF

SIEM

GuardDuty

CloudTrail

KMS

OAuth2/OIDC

Job description

Job Description:

Bamboo Card is a Dubai-based B2B distributor of digital prepaid products and a rewards fulfilment partner to enterprises worldwide. Since 2018 we have built a catalogue of more than 3,500 products across over 80 countries, delivered through our client portal and API. More than 1,000 enterprise clients rely on us to power rewards programmes, employee incentives, customer acquisition campaigns and marketplace inventory. We sit in one of the fastest‑growing corners of the payments ecosystem with the banking infrastructure and supplier relationships that make global digital rewards work at scale.

We are looking for a hands‑on Security Lead to own the security of the whole platform end to end and make Bamboo Card a hard target. You will find weaknesses before attackers do, build security into how we design and ship, and lead the response when something goes wrong. You will set the strategy, but you will also review architecture, read code, dig into logs, and harden systems yourself.

Security Strategy & Governance

• Own the security roadmap across infrastructure, applications, APIs, and data, and report security posture and risk to the CTO and leadership.
• Define and maintain security policies, standards, and a living risk register.
• Build out the security function as the company grows, including tooling, processes, and future hires.

Application, API & Identity Security

• Protect the public B2B and B2C portals and partner APIs against OWASP Top 10 attacks, API abuse, credential stuffing, bots, and fraud patterns.
• Own identity and access security for customers and staff: Cognito, SSO, MFA, session management, and account takeover prevention.
• Secure data exchange between departments, suppliers, and marketplaces: authentication, authorisation, encryption, and secrets management.
• Work with the purchase monitoring team to detect abnormal client activity and fraud early.

Cloud & Infrastructure Security

• Harden our AWS environment: IAM and IAM Identity Center, network segmentation, KMS, WAF, Shield, GuardDuty, Security Hub, and CloudTrail.
• Enforce least‑privilege access across AWS accounts, GitHub, and internal tools, with regular access reviews.
• Partner with the DevOps team to embed security in infrastructure as code and GitHub Actions pipelines.

Secure Development

• Run threat modelling for new features and integrations, and review high‑risk designs and code.
• Integrate SAST, DAST, dependency, secret, and container scanning into CI/CD, with clear fix SLAs.
• Train engineers on secure coding and make the secure path the easy path.

Detection, Response & Testing

• Build monitoring, detection, and alerting (SIEM, GuardDuty, CloudWatch) with actionable alerts.
• Own the incident response plan; lead incidents from detection through containment, client communication, and post‑mortem.
• Run vulnerability management, coordinate external penetration tests, and make sure findings get fixed.
• Run tabletop exercises and maintain business continuity and disaster recovery plans with engineering.

Compliance, Vendors & Awareness

• Drive GDPR, UAE PDPL, and other regional data protection requirements; lead us towards ISO 27001 or SOC 2.
• Assess the security of suppliers, marketplaces, and third‑party vendors before and during integration.
• Run security awareness and phishing training across the company and be the go‑to person for security questions.

Technical Expertise

• 10+ years in information security, with at least 3 years in a lead or senior role.
• Deep, hands‑on experience securing production AWS environments.
• Strong web application and API security: OAuth2/OIDC, mTLS, API gateways, WAF, rate limiting, and bot protection.
• Experience protecting systems that handle sensitive or financial data, including fraud and account takeover scenarios.
• Real incident response experience, not just writing the runbook.
• Comfortable reading code and reviewing architecture; .NET, SQL Server, or GitHub Actions background is a plus.
• Working knowledge of GDPR, UAE PDPL, and frameworks such as ISO 27001, SOC 2, NIST, or CIS.

Leadership & Communication

• Explains risk clearly to engineers, executives, and clients, and pushes back when needed.
• Influences teams without slowing them down; balances security with delivery.
• Experience building or scaling a security function is a strong advantage.
• Certifications such as OSCP, CISSP, CCSP, or AWS Security Specialty, and a background in payments, fintech, or gift cards, are a plus.
• Real ownership of security for a fast‑growing global digital gifting platform.
• Competitive salary and benefits package aligned to the UAE market (visa, health insurance, and additional benefits).
• Direct line to the CTO and real influence over security tooling, architecture, and priorities.
• A diverse, entrepreneurial technology team that values ownership, accuracy, and continuous improvement.
• The chance to be part of Bamboo Card’s next chapter as we scale our platform and grow across new markets.