Lead Information Security Engineer (Defensive)

About the role

Tabby is seeking a Lead Information Security Engineer to drive defensive security initiatives across its rapidly growing FinTech platform. Based in Riyadh, you will lead a team of engineers and analysts, shaping security architecture, cloud posture, and secure development practices.

Key responsibilities

• Lead security architecture and design reviews for IT, cloud, and product initiatives.
• Drive cloud security across GCP and AWS, including IAM, security posture, and infrastructure hardening.
• Own the Secure SDLC/DevSecOps program, managing SAST, DAST, SCA, and container security.
• Lead vulnerability management, penetration testing, and red‑team engagements.
• Oversee endpoint, infrastructure, and firewall security.
• Develop detection engineering, threat intelligence, and complex incident response capabilities.
• Mentor and grow a team of cybersecurity engineers and analysts.
• Partner with Engineering, IT, Compliance and other stakeholders to improve overall security posture.

Required profile

• 5+ years of cybersecurity experience with senior‑level or technical leadership responsibilities.
• Strong background in security architecture, cloud security, AppSec/DevSecOps, and vulnerability management.
• Hands‑on experience with offensive and defensive techniques, including penetration testing, red/purple teaming, and incident response.
• Familiarity with regulatory frameworks such as SAMA CSF, NCA ECC, PCI‑DSS, and ISO 27001.
• Proven ability to lead teams, manage stakeholders, and drive security initiatives.
• Relevant certifications required: CISSP or CISM and OSCP (or equivalent).

Required skills

• GCP and AWS cloud platforms
• IAM, Terraform, Kubernetes, CI/CD pipelines
• SAST, DAST, SCA, container security
• SIEM, EDR/XDR, CSPM, DLP, vulnerability management tools
• Penetration testing, red‑team operations, incident response
• Detection engineering, threat intelligence, endpoint and firewall security
• Security architecture, cloud security, AppSec, DevSecOps