Information Security Lead

Role overview

Take hands-on responsibility for information security across APIs, cloud infrastructure, third-party connections, and incident response in a financial technology environment. This is a technical lead role: you set security standards and make decisions while also carrying out threat modelling, reviews, remediation, and incident leadership. You will explain risks clearly to engineers, executives, and regulators, and serve as an after-hours escalation contact for security incidents.

Responsibilities - Set and maintain security requirements for public and partner APIs, including authentication, secrets, request signing, rate limits, and input validation. - Threat-model new partner integrations, review existing connections, and monitor third-party traffic for anomalies and traceability. - Manage web application firewall rules, vulnerability scanning, and security checks in development pipelines; scope penetration tests and drive findings through remediation. - Oversee security monitoring, alerting, incident plans, tabletop exercises, and response through post-incident review. - Own security controls and audit evidence for the information security management system, supporting alignment with applicable privacy and financial-sector requirements. - Set standards for an outsourced endpoint security provider, coordinate access reviews with system administration, and maintain security guidance and runbooks.

Requirements - At least six years in information security, including three or more years in application, API, or cloud security. - Practical API security experience with OAuth 2.0 or OIDC, JWT, mutual TLS, request signing, and common API security risks. - Hands-on AWS security experience, including identity and access management, key management, audit logging, threat detection, and web application firewall tools. - Experience threat-modelling systems, reviewing code, arranging penetration tests, and managing remediation. - Experience leading incident response and managing an outsourced security provider against defined standards. - Python or Bash scripting skills, plus at least one relevant security or cloud certification, such as CISSP, CISM, OSCP, OSWE, GWAPT, or AWS Security Specialty.

Nice to have Experience in regulated payments or banking, PCI DSS, ISO 27001 implementation or audits, SIEM or detection engineering, Kubernetes security, or infrastructure as code.