Senior Manager Information Security

Company Overview

Tabby is a fintech company revolutionizing how people manage money by providing financial freedom through smarter shopping, earning, and saving. Serving over 17 million users, Tabby enables them to control their spending efficiently. Its primary product empowers shoppers to split payments online and offline with zero fees or interest, partnering with more than 40,000 global brands including Amazon, Noon, IKEA, and SHEIN. With an annual transaction volume surpassing $10 billion, Tabby is recognized as the leading fintech in the GCC market. Established in 2019, the company has secured over $1 billion in funding and is valued at $4.5 billion.

Role Overview

The Senior Manager Information Security will spearhead Tabby's security strategy and manage the information security team. This role covers strategic planning and practical management of core security programs focused on cloud security, security architecture, application security, vulnerability assessments, threat detection, and incident management.

Primary Responsibilities

• Guide and actively participate in designing security architectures and conducting technical security evaluations related to cloud, infrastructure, and product developments.
• Implement and manage security controls in cloud environments (GCP and AWS) including Identity and Access Management (IAM), Cloud Security Posture Management (CSPM), and cloud-native security tools.
• Lead initiatives in Secure Software Development Lifecycle (SDLC) and DevSecOps practices such as Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Software Composition Analysis (SCA), and container security integration.
• Oversee vulnerability management programs and engage in penetration tests, Vulnerability Assessment and Penetration Testing (VAPT), as well as red and purple team exercises.
• Develop and refine threat detection strategies, Security Information and Event Management (SIEM) use cases, and overall security monitoring.
• Lead and contribute to handling intricate security incident investigations and responses.
• Promote security enhancements for endpoints, infrastructure, network, and firewalls.
• Drive automation of security processes and create necessary security tools.
• Establish and uphold technical security standards, best practices, and operational procedures.
• Manage, guide, and develop a team of security engineers and analysts.
• Collaborate closely with Engineering, Infrastructure, Product, IT, Legal, and Compliance teams to embed security practices across the company.

Skills and Qualifications

• Extensive experience in leading information or cybersecurity functions, either in senior technical or management capacities.
• Minimum five years in information security or cybersecurity, including at least two years in a leadership or senior technical role; prior experience managing teams is highly desirable.
• In-depth knowledge of cloud security, security architecture, vulnerability testing, application security, DevSecOps, and defensive security practices.
• Experience managing security programs and leading cross-functional projects.
• Proficient with cloud platforms GCP and AWS; expertise in IAM, CSPM, SIEM, EDR/XDR, and vulnerability management solutions.
• Strong understanding of penetration testing methodologies, red/purple team operations, threat hunting, and incident response mechanisms.
• Hands-on experience with SAST, DAST, Software Composition Analysis, and container security in Continuous Integration/Continuous Deployment environments.
• Knowledgeable in security architecture design, threat modeling, and enterprise-wide security controls.
• Background working within regulated financial technology or banking sectors.
• Familiarity with regulatory frameworks such as CBUAE, UAE PDPL, PCI-DSS, ISO 27001, and SOC 2.
• Proven leadership capabilities, excellent stakeholder management, and strategic decision-making skills.
• Relevant certifications such as CISSP, CISM, or OSCP are preferred or required depending on hiring decisions.