Head of Security

Ameera Talent Solutions; Kuwait; On-site; KWD 80,000 - 120,000; Full time

Job summary

A leading e-commerce company in Kuwait seeks a Head of Security to lead and evolve the security function. You will shape strategy, build a lean team, and drive adoption of security across engineering and business units.

10+ years in cybersecurity with 5+ years in leadership, and hands-on expertise in cloud, APIs, and protection of customer data. Fluency in English; Arabic preferred for local market interaction.

Qualifications

• 10+ years in information or cybersecurity.
• 5+ years leading security teams or programmes.
• Experience in e-commerce/rapid-growth digital businesses.
• Hands-on depth in application, API, cloud, IAM, and incident response.
• Proven ability to partner with engineering and business teams.

Responsibilities

• Develop and execute a security strategy and roadmap aligned with business priorities.
• Define operating model and hiring priorities; manage security budget and vendors.
• Oversee security architecture across web, mobile, cloud, and identity platforms.
• Lead major incident response and ensure compliance with data protection requirements in Kuwait.

Skills

Security leadership

Strategic planning

Threat modeling

Security architecture

Incident response

Education

Bachelor's/Master's in CS/InfoSec

Tools

ISO 27001

NIST CSF

PCI DSS

Job description

Head of Security
build and lead the function

A leading e-commerce company in Kuwait, serving millions of customers across its web and mobile platforms.

Level Head of function

Experience 10+ years, 5+ leading

Language English. Arabic preferred

We need a security leader who makes sound technical calls personally, builds a lean team supported by trusted partners, and gets engineering and business teams to adopt the changes.

01

Scope of the function

Four capabilities. In-house staff and managed or specialist partners, chosen where each makes sense.

Governance, Risk and Compliance

Policies, risk management, audit, regulatory and data protection compliance, third-party risk.

Security Engineering

Application, API, mobile, cloud and identity security, plus secure software delivery.

Security Operations and Response

Monitoring, detection, digital forensics and incident response, including fraud and abuse incidents.

Offensive Security

Penetration testing, abuse-case testing of business logic, adversary simulation, control validation.

02

Key responsibilities

Working with Technology leadership.

Strategy and leadership

• Develop and execute a security strategy and roadmap aligned with business priorities, risk exposure and growth.
• Define the operating model, decide what to build in-house and what to source, set hiring priorities and measurable objectives.
• Own the security budget, assess technology investments and manage security vendors.
• Report security performance and significant risks to executive management and board-level governance.

Platform and engineering security

• Oversee security architecture across web, mobile, APIs, cloud, corporate systems and identity platforms.
• Build security into delivery: enforceable code review, secrets management, code and dependency scanning, sign-off on high-risk changes.
• Apply the same discipline to integration, low-code, internal tools and AI-assisted tooling that can reach production data.
• Enforce least-privilege access with regular access reviews. Strengthen bot management, rate limiting, WAF and transport security.

Fraud, abuse and commerce risk

• Work with Fraud, Finance, Customer Service and Product to stop account takeover, credential stuffing, gift card and store credit abuse, promotion and refund abuse, payment fraud.
• Threat-model business logic before launch and test it afterwards.
• Secure the partner and seller ecosystem, including partner portal access and timely offboarding.

Detection, response and assurance

• Make security data searchable and detections tested. Build escalation paths, playbooks and regular exercises.
• Lead major incident response: investigation, containment, recovery, communication and post-incident improvement.
• Direct pentesting and vulnerability management with remediation SLAs and a formal risk acceptance process.
• Lead audit coordination. Ensure compliance with data protection regulations in Kuwait, and PCI DSS for payment flows.

03

Required experience

What we need to see in the first conversation.

• 10+ years in information or cybersecurity, including 5+ years leading security teams or programmes.
• E-commerce, online marketplace, consumer technology or comparable high-volume customer-facing digital business.
• A proven record of building or maturing a security function from an early stage with limited headcount and effective use of partners.
• Hands-on depth in application, API and mobile security, cloud and container security, IAM, vulnerability management and incident response. Able to challenge engineering decisions at design and code level.
• Practical fight against fraud and abuse: account takeover, bots, promotion, gift card and store credit abuse.
• End-to-end management of significant incidents, including forensics and business communication.
• Working knowledge of ISO 27001, NIST CSF, PCI DSS v4.x and data protection requirements in Kuwait.
• Fluent English, spoken and written.
• Proven prioritisation of security investment against operational and commercial needs. Able to present risk to senior management and the board.

Preferred

• Arabic speakers preferred.
• Experience in the Kuwait market and its regulators.
• Public cloud, Kubernetes, modern CI/CD, edge security, bot management, managed detection and response.
• Experience securing AI-enabled tools that can access production.
• Governance experience in a growing business or public-company readiness.
• CISSP, CISM or CCISO. Hands-on certifications such as OSCP are valued.