Cybersecurity Engineer (Cloud & IT) - Remote

Title: Cybersecurity Engineer (Cloud & IT) - Remote

Location: Remote

## About the Role

erad is a Sharia-compliant fintech providing SME financing in Saudi Arabia and the UAE, licensed by the CMA in KSA and the DFSA in the UAE. We are hiring a Cybersecurity Engineer to own the security of our platform, our people and our devices. You will report to the CTO and work with a fully distributed engineering team that ships with AI-assisted tooling every day. We especially want to hear from penetration testers and security auditors who are ready to move from finding the issues to owning the fixes.

## What You'll Do

**Security engineering and testing**

• Own the security posture of our cloud environment: identity and access, network exposure, host hardening and patching, secrets, and logging coverage.
• Test our own products the way an attacker would: regular internal pentests of our web apps and APIs, plus scoping and retests with external testers.
• Build and run vulnerability management across code, dependencies, hosts and third-party software, with remediation SLAs tracked to closure.
• Review designs and pull requests with engineers, and build security into our delivery pipeline.

**Detection and response**

• Own security alerting and keep it useful rather than noisy.
• Lead incident response end to end: triage, containment, investigation, root cause and the write-up for management and regulators.
• Run phishing awareness, tabletop exercises and restore tests.

**Governance and compliance**

• Run our ISMS: control evidence, risk register, policies, vendor security reviews, access reviews and audit support.
• Turn regulatory requirements (CMA, DFSA, and KSA and UAE data protection law) into practical controls and evidence.

**IT (around 20% of your time)**

• Run joiner, mover and leaver access: accounts, SSO, app roles, offboarding and data handover.
• Manage company laptops through MDM: enrolment, configuration, encryption and app deployment.
• Administer our identity and collaboration tools, the company password manager and MFA.
• Automate the repetitive parts so IT stays a small slice of the job.

## Qualifications & Experience

• 3+ years in security, ideally including time as a penetration tester or security auditor at a pentest firm, security consultancy or compliance platform.
• Hands-on web application, API and cloud penetration testing: you can find and exploit real vulnerabilities, write them up clearly, and work with engineers on the fix.
• Practical security experience on at least one major cloud provider: IAM, network controls and logging.
• Experience with WAF and zero-trust access tooling.
• Strong Linux and networking fundamentals: SSH, TLS, DNS, firewalls and VPNs.
• Comfortable writing automation in Python or Bash, and reviewing application code for security issues (OWASP Top 10).
• Incident response experience, including investigating from raw logs.
• Familiarity with ISO 27001 or SOC 2 controls and producing audit evidence.
• Some experience administering an identity provider and managing devices with an MDM.
• Uses AI tools to work faster and checks their output critically.
• Fluent English, written and spoken.

## Skills (Nice-to-Haves)

• Experience in fintech, banking or other regulated financial services, ideally with GCC regulators.
• Certifications such as OSCP, OSWE, CREST, CISSP, CCSP, a cloud provider security certification, or ISO 27001 Lead Implementer or Lead Auditor.
• Container security, infrastructure as code and CI/CD security.
• Knowledge of the Saudi and UAE personal data protection laws.
• Red-team experience, published CVEs, bug bounty findings or CTF results.
• Experience as the first or only security engineer at a startup.
• Arabic is a plus.