Security Lead

Bamboo Card is a Dubai-based B2B distributor of digital prepaid products and a rewards fulfilment partner to enterprises worldwide. Since 2018 we have built a catalogue of more than 3,500 products across over 80 countries, delivered through our client portal and API. More than 1,000 enterprise clients rely on us to power rewards programmes, employee incentives, customer acquisition campaigns and marketplace inventory. We sit in one of the fastest-growing corners of the payments ecosystem with the banking infrastructure and supplier relationships that make global digital rewards work at scale.
We are looking for a hands-on Security Lead to own the security of the whole platform end to end and make Bamboo Card
a hard target. You will find weaknesses before attackers do, build security into how we design and ship, and lead the
response when something goes wrong. You will set the strategy, but you will also review architecture, read code, dig into
logs, and harden systems yourself.
Technical Expertise
• 10+ years in information security, with at least 3 years in a lead or senior role.
• Deep, hands-on experience securing production AWS environments.
• Strong web application and API security: OAuth2/OIDC, mTLS, API gateways, WAF, rate limiting, and bot protection.
• Experience protecting systems that handle sensitive or financial data, including fraud and account takeover
scenarios.
• Real incident response experience, not just writing the runbook.
• Comfortable reading code and reviewing architecture; .NET, SQL Server, or GitHub Actions background is a plus.
• Working knowledge of GDPR, UAE PDPL, and frameworks such as ISO 27001, SOC 2, NIST, or CIS.
Leadership & Communication
• Explains risk clearly to engineers, executives, and clients, and pushes back when needed.
• Influences teams without slowing them down; balances security with delivery.
• Experience building or scaling a security function is a strong advantage.
• Certifications such as OSCP, CISSP, CCSP, or AWS Security Specialty, and a background in payments, fintech, or gift cards, are a plus.
Security Strategy & Governance
• Own the security roadmap across infrastructure, applications, APIs, and data, and report security posture and risk to the CTO and leadership.
• Define and maintain security policies, standards, and a living risk register.
• Build out the security function as the company grows, including tooling, processes, and future hires.
Application, API & Identity Security
• Protect the public B2B and B2C portals and partner APIs against OWASP Top 10 attacks, API abuse, credential
stuffing, bots, and fraud patterns.
• Own identity and access security for customers and staff: Cognito, SSO, MFA, session management, and account
takeover prevention.
• Secure data exchange between departments, suppliers, and marketplaces: authentication, authorisation, encryption, and secrets management.
• Work with the purchase monitoring team to detect abnormal client activity and fraud early.
Cloud & Infrastructure Security
• Harden our AWS environment: IAM and IAM Identity Center, network segmentation, KMS, WAF, Shield, GuardDuty, Security Hub, and CloudTrail.
• Enforce least-privilege access across AWS accounts, GitHub, and internal tools, with regular access reviews.
• Partner with the DevOps team to embed security in infrastructure as code and GitHub Actions pipelines.
Secure Development
• Run threat modelling for new features and integrations, and review high-risk designs and code.
• Integrate SAST, DAST, dependency, secret, and container scanning into CI/CD, with clear fix SLAs.
• Train engineers on secure coding and make the secure path the easy path.
Detection, Response & Testing
• Build monitoring, detection, and alerting (SIEM, GuardDuty, CloudWatch) with actionable alerts.
• Own the incident response plan; lead incidents from detection through containment, client communication, and
post-mortem.
• Run vulnerability management, coordinate external penetration tests, and make sure findings get fixed.
• Run tabletop exercises and maintain business continuity and disaster recovery plans with engineering.
Compliance, Vendors & Awareness
• Drive GDPR, UAE PDPL, and other regional data protection requirements; lead us towards ISO 27001 or SOC 2.
• Assess the security of suppliers, marketplaces, and third-party vendors before and during integration.
• Run security awareness and phishing training across the company and be the go-to person for security questions.
• Real ownership of security for a fast-growing global digital gifting platform.
• Competitive salary and benefits package aligned to the UAE market (visa, health insurance, and additional benefits).
• Direct line to the CTO and real influence over security tooling, architecture, and priorities.
• A diverse, entrepreneurial technology team that values ownership, accuracy, and continuous improvement.
• The chance to be part of Bamboo Card’s next chapter as we scale our platform and grow across new markets.