Information Security Lead

Mama Money; Finland; On-site; EUR 90,000 - 130,000; Full time

Job summary

Mama Money seeks a hands-on Senior Security Engineer in Finland to own security across APIs, partner integrations, and outsourced security operations. You’ll set standards, perform threat modelling, review code and integrations, and lead incident response with clear risk communication to engineers, leadership, and regulators.

You’ll partner with SRE and development teams to bake security into pipelines, manage IAM/secrets, WAF, and third-party risk reviews.

Qualifications

• 6+ years in information security, with at least 3 in application, API or cloud security.
• Hands-on API security practices including OAuth 2.0/OIDC, JWT, mTLS, and API security standards.

Responsibilities

• Own the security of public and partner APIs: authentication, secrets handling, request signing, rate limiting, input validation.
• Threat model every new partner integration and review existing ones.
• Monitor third-party calls for anomalies and trace data flow.
• Own WAF and edge security; tune rules, manage bot/DDoS protection, minimize false positives.
• Set up alerts for unusual traffic and investigate incidents promptly.
• Integrate security into development: code review, dependency and secrets scanning, SAST/DAST.
• Run penetration tests and remediate findings; assess third-party risk before connections.
• Own relationship with outsourced provider for security operations and reporting.
• Lead incident response and tabletop exercises; ensure ISO 27001 ISMS controls are maintained.

Skills

API security

Threat modelling

Incident response

IAM

OAuth 2.0 / OIDC

JWT

mTLS

OWASP API Top 10

AWS security

SAST / DAST

Penetration testing

Security provider management

Python or Bash scripting

Job description

Listed on CyberJobs.cc, a job board for cybersecurity jobs from the team behind AITraining.jobs.

Who we are

Mama Money is a growth-stage fintech on a mission to improve the financial lives of migrants and underserved communities across Africa and beyond. What started in 2015 as a cross-border payments service has grown into a multi-product financial platform - giving people the tools to send, save, and manage money on their own terms, at a socially fair price. Payments were just the beginning; today Mama Money is building the fuller financial toolkit our customers need, all under one roof.

Mama HQ is in beautiful Cape Town. We're 173 people strong (and counting), representing 19 countries across Africa, Asia, the UK, and Europe. Everything we build is in service of people who deserve better - and our culture reflects that same commitment. We've had good times and tough times, but the focus never shifts: people over profit, always.

The role, in short

You'll own security at Mama Money end to end. Your main focus is our APIs and the third-party calls our products depend on: payout partners, banks, card and KYC providers. Endpoints come second, but they matter too.

This is a lead role, not a management layer. You'll set the standards and make the calls, and you'll also do the work: threat modelling, reviewing code and integrations, running incidents. Endpoint security is managed day to day by our outsourced provider. You'll work with them directly, but the accountability for security sits with you. A big part of the role is explaining risk clearly to engineers, leadership and regulators, so clear writing matters as much as technical depth.

What you’ll actually be doing

• API and integration security: Own the security of our public and partner APIs. Set the standard for authentication, secrets handling, request signing, rate limiting and input validation.
• Threat model every new partner integration before it goes live, and review existing ones.
• Monitor third-party calls for anomalies and failures, and make sure we can trace what was sent where.
• Edge and traffic protection: Own and manage our WAF. Write and tune its rules, manage bot and DDoS protection, and keep false positives low enough that customers aren't blocked.
• Set up alerting on unusual traffic, such as spikes in volume, failed logins, unusual geographies or suspicious API usage. Investigate alerts and act on them fast.
• Secure development: Work with engineering to build security into how we ship: code review, dependency and secrets scanning, and SAST/DAST in the pipeline.
• Run penetration tests and own remediation until findings are closed. Third-party risk: Assess the security of partners and vendors before we connect to them, and keep that review current.
• Endpoint security: Own the relationship with our outsourced provider. Set the standards, hold them to SLAs, review their reporting and close the gaps.
• Security operations and incident response: Own monitoring and alerting, the incident response plan and tabletop exercises. Lead incidents when they happen.
• Compliance: Own the security controls in our ISMS under ISO 27001. Support audits with working evidence, and keep us aligned with POPIA and FSCA, Prudential Authority and SARB cybersecurity requirements.
• Work with our System Administrator on access management, least privilege and access reviews.
• Run security awareness for the whole company, and keep documentation and runbooks current.

What we’re looking for

• 6+ years in information security, with at least 3 in application, API or cloud security.
• Hands-on API security: OAuth 2.0 and OIDC, JWT, mTLS, request signing, and the OWASP API Security Top 10.
• Practical AWS security: IAM, KMS, CloudTrail, GuardDuty, Security Hub, WAF.
• Experience threat modelling systems and reviewing code for security issues.
• Experience scoping penetration tests and driving remediation.
• Experience leading incident response, from detection to post-mortem.
• Experience managing an outsourced security provider against clear standards.
• Scripting in Python or Bash, enough to automate checks and pull evidence.
• One or more of: CISSP or CISM; OSCP, OSWE or GWAPT; AWS Certified Security, Specialty.
• After-hours: you'll be the escalation point for security incidents.

Nice to have

• Experience in a regulated environment, ideally payments or banking; FSCA, SARB or FIC exposure is a plus.
• PCI DSS experience.
• ISO 27001 implementation or audit experience.
• SIEM and detection engineering.
• Kubernetes and container security.
• Terraform or other infrastructure-as-code.

Why Mama?

We build products that help people do more with their money - from sending money home, to saving, to accessing money in ways that feel safe and simple. The work matters because it helps real people in real ways, every single day.

We're not afraid to give things a go, and we take ownership of what we do. We keep learning, support each other, and stay focused on what matters most. If you're after meaningful work and a team that genuinely cares about what they're building - this could be your next move.

Mama's Values

• Making it easier for customers
• Give it a go
• Just own it