Information Security Lead

Mama Money; Austria; On-site; EUR 90,000 - 130,000; Full time

Job summary

Mama Money is seeking a lead security engineer to own security across APIs, partners, and data flows. You will set standards, perform threat modelling, review code, and drive security across our fintech platform.

You'll partner with engineering, regulatory teams, and outsourced security providers, translating risk into clear actions and helping safeguard user money and trust.

Qualifications

• 6+ years in information security, with API or cloud security focus.
• Hands-on API security: OAuth 2.0, JWT, mTLS, request signing.
• Practical AWS security: IAM, KMS, GuardDuty, WAF.
• Experience threat modelling and code review for security issues.
• Experience leading incident response and remediation.
• Scripting in Python or Bash to automate checks.
• Certifications such as CISSP or CISM; OSCP, OSWE or GWAPT are a plus.

Responsibilities

• Own API and integration security standards for public and partner APIs.
• Threat model new partner integrations before go-live; review existing ones.
• Monitor third-party calls for anomalies and trace data flows.
• Manage WAF rules, bot protection, and DDoS defenses.
• Set up alerts for unusual traffic; investigate and act quickly.
• Embed security into CI/CD with SAST/DAST and dependency scanning.
• Lead penetration tests and remediation; assess third-party risks.
• Coordinate with outsourced provider on security operations and SLAs.
• Lead incident response and tabletop exercises; keep ISMS controls aligned.

Skills

API security

Threat modelling

AWS security

Incident response

Code review

Python/Bash scripting

Vendor management

Security governance

Tools

AWS IAM

KMS

CloudTrail

GuardDuty

WAF

SIEM

Terraform

Job description

Listed on CyberJobs.cc, a job board for cybersecurity jobs from the team behind AITraining.jobs.

Who we are

Mama Money is a growth-stage fintech on a mission to improve the financial lives of migrants and underserved communities across Africa and beyond. What started in 2015 as a cross-border payments service has grown into a multi-product financial platform - giving people the tools to send, save, and manage money on their own terms, at a socially fair price. Payments were just the beginning; today Mama Money is building the fuller financial toolkit our customers need, all under one roof.

Mama HQ is in beautiful Cape Town. We're 173 people strong (and counting), representing 19 countries across Africa, Asia, the UK, and Europe. Everything we build is in service of people who deserve better - and our culture reflects that same commitment. We've had good times and tough times, but the focus never shifts: people over profit, always.

The role, in short

You'll own security at Mama Money end to end. Your main focus is our APIs and the third-party calls our products depend on: payout partners, banks, card and KYC providers. Endpoints come second, but they matter too.

This is a lead role, not a management layer. You'll set the standards and make the calls, and you'll also do the work: threat modelling, reviewing code and integrations, running incidents. Endpoint security is managed day to day by our outsourced provider. You'll work with them directly, but the accountability for security sits with you. A big part of the role is explaining risk clearly to engineers, leadership and regulators, so clear writing matters as much as technical depth.

What you’ll actually be doing

• API and integration security: Own the security of our public and partner APIs. Set the standard for authentication, secrets handling, request signing, rate limiting and input validation.
• Threat model every new partner integration before it goes live, and review existing ones.
• Monitor third-party calls for anomalies and failures, and make sure we can trace what was sent where.
• Edge and traffic protection: Own and manage our WAF. Write and tune its rules, manage bot and DDoS protection, and keep false positives low enough that customers aren't blocked.
• Set up alerting on unusual traffic, such as spikes in volume, failed logins, unusual geographies or suspicious API usage. Investigate alerts and act on them fast.
• Secure development: Work with engineering to build security into how we ship: code review, dependency and secrets scanning, and SAST/DAST in the pipeline.
• Run penetration tests and own remediation until findings are closed. Third-party risk: Assess the security of partners and vendors before we connect to them, and keep that review current.
• Endpoint security: Own the relationship with our outsourced provider. Set the standards, hold them to SLAs, review their reporting and close the gaps.
• Security operations and incident response: Own monitoring and alerting, the incident response plan and tabletop exercises. Lead incidents when they happen.
• Compliance: Own the security controls in our ISMS under ISO 27001. Support audits with working evidence, and keep us aligned with POPIA and FSCA, Prudential Authority and SARB cybersecurity requirements.
• Work with our System Administrator on access management, least privilege and access reviews.
• Run security awareness for the whole company, and keep documentation and runbooks current.

What we’re looking for

• 6+ years in information security, with at least 3 in application, API or cloud security.
• Hands-on API security: OAuth 2.0 and OIDC, JWT, mTLS, request signing, and the OWASP API Security Top 10.
• Practical AWS security: IAM, KMS, CloudTrail, GuardDuty, Security Hub, WAF.
• Experience threat modelling systems and reviewing code for security issues.
• Experience scoping penetration tests and driving remediation.
• Experience leading incident response, from detection to post-mortem.
• Experience managing an outsourced security provider against clear standards.
• Scripting in Python or Bash, enough to automate checks and pull evidence.
• One or more of: CISSP or CISM; OSCP, OSWE or GWAPT; AWS Certified Security, Specialty.
• After-hours: you'll be the escalation point for security incidents.

Nice to have

• Experience in a regulated environment, ideally payments or banking; FSCA, SARB or FIC exposure is a plus.
• PCI DSS experience.
• ISO 27001 implementation or audit experience.
• SIEM and detection engineering.
• Kubernetes and container security.
• Terraform or other infrastructure-as-code.

Why Mama?

We build products that help people do more with their money - from sending money home, to saving, to accessing money in ways that feel safe and simple. The work matters because it helps real people in real ways, every single day.

We're not afraid to give things a go, and we take ownership of what we do. We keep learning, support each other, and stay focused on what matters most. If you're after meaningful work and a team that genuinely cares about what they're building - this could be your next move.

Mama's Values

• Making it easier for customers
• Give it a go
• Just own it