Cybersecurity Engineer (Cloud & IT) - Remote

erad; United States; Teletrabalho; USD 140 000 - 180 000; Tempo integral

Resumo da oferta

erd is a Sharia-compliant fintech providing SME financing in Saudi Arabia and the UAE. We are hiring a Cybersecurity Engineer to own the security of our platform, our people and our devices, reporting to the CTO in a fully distributed engineering team that ships with AI-assisted tooling.

We especially value penetration testers and security auditors who are ready to move from finding issues to owning fixes, with strong cloud security, incident response, and ISMS governance experience.

Qualificações

• 3+ years in security, ideally including time as a penetration tester or security auditor at a pentest firm, security consultancy or compliance platform.
• Hands-on web application, API and cloud pentesting; you can find and exploit real vulnerabilities, write them up clearly, and work with engineers on the fix.
• Practical security experience on at least one major cloud provider: IAM, network controls and logging.
• Experience with WAF and zero-trust access tooling.
• Strong Linux and networking fundamentals: SSH, TLS, DNS, firewalls and VPNs.
• Comfortable writing automation in Python or Bash, and reviewing application code for security issues (OWASP Top 10).
• Incident response experience, including investigating from raw logs.
• Familiarity with ISO 27001 or SOC 2 controls and producing audit evidence.
• Some experience administering an identity provider and managing devices with an MDM.
• Uses AI tools to work faster and checks their output critically.
• Fluent English, written and spoken.

Responsabilidades

• Security engineering and testing: Own the security posture of our cloud environment, including IAM, network exposure, host hardening and patching.
• Test our web apps and APIs with internal pentests and coordinate with external testers.
• Build and run vulnerability management across code, dependencies, hosts and third-party software with SLA tracking.
• Review designs and pull requests, embedding security into the delivery pipeline.
• Lead incident response end to end: triage, containment, investigation, root cause and write-ups for management and regulators.
• Run phishing awareness, tabletop exercises and restore tests.
• Governance and compliance: Run our ISMS, control evidence, risk register, policies, vendor security reviews, audit support.
• Translate CMA, DFSA, KSA and UAE data protection requirements into practical controls and evidence.
• IT work (≈20%): manage joiner/mover/leaver access, SSO, offboarding and data handover; manage laptops via MDM.
• Administer identity and collaboration tools, password manager and MFA; automate repetitive parts.

Conhecimentos

Security testing

Incident response

Cloud security

Python scripting

Linux fundamentals

Networking

Threat modeling

Auditing / compliance

Ferramentas

WAF

IAM

MFA

SAML

Descrição da oferta de emprego

About the Role

erd is a Sharia-compliant fintech providing SME financing in Saudi Arabia and the UAE, licensed by the CMA in KSA and the DFSA in the UAE. We are hiring a Cybersecurity Engineer to own the security of our platform, our people and our devices. You will report to the CTO and work with a fully distributed engineering team that ships with AI-assisted tooling every day. We especially want to hear from penetration testers and security auditors who are ready to move from finding the issues to owning the fixes.

What You'll Do

Security engineering and testing Own the security posture of our cloud environment: identity and access, network exposure, host hardening and patching, secrets, and logging coverage. Test our own products the way an attacker would: regular internal pentests of our web apps and APIs, plus scoping and retests with external testers. Build and run vulnerability management across code, dependencies, hosts and third-party software, with remediation SLAs tracked to closure. Review designs and pull requests with engineers, and build security into our delivery pipeline. Detection and response Own security alerting and keep it useful rather than noisy. Lead incident response end to end: triage, containment, investigation, root cause and the write-up for management and regulators. Run phishing awareness, tabletop exercises and restore tests. Governance and compliance Run our ISMS: control evidence, risk register, policies, vendor security reviews, access reviews and audit support. Turn regulatory requirements (CMA, DFSA, and KSA and UAE data protection law) into practical controls and evidence. IT (around 20% of your time) Run joiner, mover and leaver access: accounts, SSO, app roles, offboarding and data handover. Manage company laptops through MDM: enrolment, configuration, encryption and app deployment. Administer our identity and collaboration tools, the company password manager and MFA. Automate the repetitive parts so IT stays a small slice of the job.

Qualifications & Experience

3+ years in security, ideally including time as a penetration tester or security auditor at a pentest firm, security consultancy or compliance platform. Hands-on web application, API and cloud penetration testing: you can find and exploit real vulnerabilities, write them up clearly, and work with engineers on the fix. Practical security experience on at least one major cloud provider: IAM, network controls and logging. Experience with WAF and zero-trust access tooling. Strong Linux and networking fundamentals: SSH, TLS, DNS, firewalls and VPNs. Comfortable writing automation in Python or Bash, and reviewing application code for security issues (OWASP Top 10). Incident response experience, including investigating from raw logs. Familiarity with ISO 27001 or SOC 2 controls and producing audit evidence. Some experience administering an identity provider and managing devices with an MDM. Uses AI tools to work faster and checks their output critically. Fluent English, written and spoken.

Skills (Nice-to-Haves)

Experience in fintech, banking or other regulated financial services, ideally with GCC regulators. Certifications such as OSCP, OSWE, CREST, CISSP, CCSP, a cloud provider security certification, or ISO 27001 Lead Implementer or Lead Auditor. Container security, infrastructure as code and CI/CD security. Knowledge of the Saudi and UAE personal data protection laws. Red-team experience, published CVEs, bug bounty findings or CTF results. Experience as the first or only security engineer at a startup. Arabic is a plus.