Information Security Lead: API & Cloud Security Champion

Mama Money; Pakistan; On-site; PKR 4,000,000 - 8,000,000; Full time

Job summary

Mama Money is seeking a senior security engineer to own security end-to-end for APIs and third-party integrations. You will set security standards, perform threat modelling, review code and integrations, and manage incidents with an outsourced provider while communicating risk clearly to engineers, leadership, and regulators.

Responsibilities include securing development pipelines, monitoring third-party calls, and leading ISO 27001 controls alignment.

Qualifications

• 6+ years in information security with at least 3 in application, API or cloud security.
• Hands-on API security: OAuth 2.0 and OIDC, JWT, mTLS, request signing, and the OWASP API Security Top 10.
• Practical AWS security: IAM, KMS, CloudTrail, GuardDuty, Security Hub, WAF.
• Experience threat modelling systems and reviewing code for security issues.
• Experience scoping penetration tests and driving remediation.
• Experience leading incident response, from detection to post-mortem.
• Experience managing an outsourced security provider against clear standards.
• Scripting in Python or Bash, enough to automate checks and pull evidence.
• One or more of: CISSP or CISM; OSCP, OSWE or GWAPT; AWS Certified Security, Specialty.
• After-hours: escalation point for security incidents.

Responsibilities

• Own the security of public and partner APIs: authentication, secrets handling, request signing, rate limiting, input validation.
• Threat model new partner integrations before go-live and review existing ones.
• Monitor third-party calls for anomalies and traceability.
• Own and manage our WAF; tune rules and protect against bot and DDoS while minimizing false positives.
• Set up alerts for unusual traffic and investigate/respond quickly.
• Integrate security into development: code review, dependency and secrets scanning, SAST/DAST in CI/CD.
• Run penetration tests and own remediation until fixed; assess third-party risk before connections.
• Manage relationship with outsourced security provider; ensure SLAs and reporting.
• Lead security operations: monitoring, incident response plans, tabletop exercises.
• Ensure ISMS controls per ISO 27001 and alignment with POPIA, FSCA, PR Authority, SARB.

Skills

API security

Threat modelling

AWS security

Incident response

Scripting Python

Code review

Vendor management

OAuth 2.0

Tools

WAF

IAM

KMS

GuardDuty

CloudTrail

Security Hub

Job description

Mama Money is seeking a senior security engineer to own security end-to-end for APIs and third-party integrations. You will set security standards, perform threat modelling, review code and integrations, and manage incidents with an outsourced provider while communicating risk clearly to engineers, leadership, and regulators.

Responsibilities include securing development pipelines, monitoring third-party calls, and leading ISO 27001 controls alignment.