Senior Security Engineer

Calo Inc.; Dubai; On-site; AED 300,000 - 420,000; Full time

Job summary

Calo Inc. is seeking a Senior Security Engineer to own and elevate our security posture across cloud infrastructure, application security and compliance. This hands-on role involves designing controls, automating checks, identifying risks, and shipping fixes with engineering teams to production.

You'll help maintain audit readiness with evidence and controls in Drata, while embedding security into everyday delivery and guiding the company through secure growth in a fast-paced startup environment.

Qualifications

• 6 years of experience in security engineering or a closely related role.
• Proven experience leading security efforts in startups or high-growth environments.
• Strong hands-on background to identify, fix, and ship issues to production.
• Understanding of secure system design and vulnerability classes (OWASP Top 10, auth, session, API security).
• Experience securing AWS environments: IAM, KMS, encryption, secrets management, logging, auditing, network controls.
• Experience securing CI/CD pipelines, build systems and runtime environments.
• Incident response, vulnerability management and security monitoring experience.
• Clear communicator who explains risk trade-offs and recommendations.

Responsibilities

• Own and drive security roadmap with high-risk areas.
• Embed security into delivery with Platform, Product, Engineering, Data, Leadership.
• Benchmark systems against OWASP Top 10, ASVS, CIS; translate findings into remediation plans.
• Run threat modeling and security reviews for major architectural or product changes.
• Triage findings and deploy fixes to production.
• Strengthen IAM, secrets management, encryption, logging, and secure networking.
• Ensure secure baselines in production (hardening, patching, access control, auditing).
• Review and improve WAF rules, rate limiting, abuse prevention.
• Build incident response playbooks and drive post-incident improvements.
• Support GDPR/PDPL security and privacy requirements.
• Maintain control mapping and evidence in Drata with automation.

Skills

Security engineering

Startup experience

Hands-on security

Secure design

AWS security

CI/CD security

Incident response

Security communication

Job description

About Calo (more here)

Calo is an app providing personalized meal plans for busy people through nutritional algorithms built with love by chefs nutritionists and software engineers.

Launched in Bahrain in 2019 we have since expanded to 7 countries delivered millions of meals to our customers and are now expanding our mission of making healthy easy to retail and other verticals.

Were on a noble mission to make healthy easy. We think this is one of the most important problems to tackle in our world today. We have global ambitions - no small thinking here.

Why This Role Matters

Security is foundational to how we scale responsibly. As our systems products and data grow this role ensures we reduce real risk while enabling fast confident delivery. Youll help set the security bar across infrastructure applications and compliance building strong guardrails without slowing teams down.

This role sits within the Platform team and plays a critical role in protecting our customers systems and business.

Role Overview

We're looking for a Senior Security Engineer to own and elevate our security posture across cloud infrastructure application security and compliance.

This is a hands-on execution-driven role. Youll design and implement controls automate security checks proactively identify risks and work closely with engineering teams to ship fixes into production. Youll also help the company stay audit-ready by maintaining evidence and controls in tools like Drata.

What Youll Do

• Own and drive the security roadmap by identifying high-risk areas prioritizing work and delivering measurable improvements.

• Work closely with Platform Product Engineering Data and Leadership to embed security into everyday delivery.

• Benchmark systems against relevant standards (e.g. OWASP Top 10 / ASVS CIS where applicable) and translate findings into clear actionable remediation plans.

• Run threat modeling and security reviews for major architectural or product changes.

• Proactively identify and remediate security issues across: Application code and APIs Cloud infrastructure and configurations & Authentication authorization secrets and data access.

• Personally triage findings write fixes and work with teams to get changes merged and deployed safely to production.

• Strengthen IAM least privilege secrets management encryption logging/monitoring and secure networking practices.

• Ensure production environments follow secure baseline practices (hardening patching access control auditing).

• Review and improve WAF rules rate limiting and abuse prevention in a practical measurable way.

• Build and maintain incident response playbooks support investigations and drive post-incident improvements.

• Support security and privacy requirements relevant to the business (e.g. GDPR PDPL).

• Maintain control mapping and evidence in Drata (or similar tools) with a strong focus on automation.

What Were Looking For

• 6 years of experience in security engineering or a closely related role.

• Proven experience leading security efforts in startups or high-growth environments.

• Strong hands-on background you can identify an issue fix it and ship it to production yourself.

• Solid understanding of secure system design and common vulnerability classes (OWASP Top 10 auth/session security API security data protection).

• Solid experience securing AWS environments: IAM KMS/encryption secrets management logging/auditing network controls.

• Experience securing CI/CD pipelines build systems and runtime environments.

• Experience with incident response vulnerability management and security monitoring.

• Clear communicator who can explain risk trade-offs and recommendations in a way teams actually adopt.

Who You Are

• Practical and execution-driven you focus on reducing real risk not writing security theatre.

• Comfortable operating independently and setting priorities without heavy process.

• Collaborative by default you partner with engineers and enable them with secure defaults.

• High-ownership mindset you take problems from discovery all the way to production.

• Experienced in startup environments and comfortable with ambiguity and speed.

• Background outside of heavily regulated fintech environments (preferred).

The Hiring Journey

• Screening meeting with TA

• Case Study

• Technical interview 1

• Technical interview 2

• Culture-fit interview

• Offer stage

Ready to Join