Head of Security

About the role

The company is a leading e‑commerce platform in Kuwait looking for a senior security leader to build and run a comprehensive security function. The role reports to technology leadership and works closely with engineering, fraud, finance and product teams.

Key responsibilities

• Define and execute a security strategy and roadmap aligned with business priorities, risk exposure and growth.
• Design the operating model, decide on in‑house versus partner delivery, set hiring priorities and manage the security budget.
• Oversee security architecture for web, mobile, APIs, cloud, corporate systems and identity platforms.
• Integrate security into software delivery through enforceable code reviews, secrets management, dependency scanning and sign‑off on high‑risk changes.
• Lead fraud, abuse and commerce‑risk programs, including account takeover prevention and payment fraud mitigation.
• Build detection, escalation, playbooks and lead major incident response, forensics and post‑incident improvement.
• Manage penetration testing, vulnerability remediation SLAs and formal risk acceptance processes.
• Ensure compliance with Kuwait data‑protection regulations, ISO 27001, NIST CSF and PCI DSS.

Required profile

• 10+ years in information or cybersecurity, with at least 5 years leading security teams or programmes.
• Experience in high‑volume e‑commerce or consumer‑technology environments.
• Proven track record of building a security function from an early stage using limited headcount and partners.
• Hands‑on expertise in application, API, mobile, cloud, container and IAM security.
• Demonstrated ability to challenge engineering decisions at design and code level.
• Fluent English (spoken and written); Arabic preferred.

Required skills

• Application security
• API security
• Mobile security
• Cloud security (public cloud, Kubernetes)
• Identity and Access Management (IAM)
• Vulnerability management
• Incident response and digital forensics
• Penetration testing and abuse‑case testing
• Secure software delivery (code review, secrets management, dependency scanning)
• Least‑privilege access controls
• Bot management and WAF
• PCI DSS, ISO 27001, NIST CSF compliance
• CI/CD pipelines