Description review
Cybersecurity Engineer (Cloud & IT) - Remote
erad · Remote · back to the listing
HR standards
66/100
needs work
Title ↔ description
85/100
strong
Reads as
Security Engineer
100% confident
What this role officially is
ICT security administrator — ESCO, the EU occupation classification
ICT security administrators plan and carry out security measures to protect information and data from unauthorised access, deliberate attack, theft and corruption.
Also known as: network security administrator, system security administrator, ICT security administrators, IT security administrator
How others title the same work
Large employers
- Security Risk Management Specialist Canonical Ltd.
- Security Software Engineer Canonical Ltd.
- Senior Security Operations Engineer Canonical Ltd.
- Staff Security Operations Engineer Canonical Ltd.
- Ubuntu Security Engineer Canonical Ltd.
Startups
- Security Engineer (Bangalore, India) AiPrise
- Security & Trust Engineer Alex
- Elucid | Senior Security Engineer | Boston, MA | ONSITE (hybrid) | $130k–$170k Elucid
- Factory | Security Engineer | ONSITE, San Francisco, CA | Full-Time Factory
- Factory | Security Engineer | Onsite in San Francisco | Full-time Factory
What the listing never says
- 31 bullet points. Long requirement lists deter qualified candidates, who read them as hard gates. Scope clarity
- No pay range published. Candidates cannot tell whether applying is worth their time. Pay transparency
The listing, marked up
Nothing in the wording of this listing tripped a check. The scores above still judge how complete and coherent it is.
About the Role
erad is a Sharia-compliant fintech providing SME financing in Saudi Arabia and the UAE, licensed by the CMA in KSA and the DFSA in the UAE. We are hiring a Cybersecurity Engineer to own the security of our platform, our people and our devices. You will report to the CTO and work with a fully distributed engineering team that ships with AI-assisted tooling every day. We especially want to hear from penetration testers and security auditors who are ready to move from finding the issues to owning the fixes.
What You'll Do
Security engineering and testing
• Own the security posture of our cloud environment: identity and access, network exposure, host hardening and patching, secrets, and logging coverage.
• Test our own products the way an attacker would: regular internal pentests of our web apps and APIs, plus scoping and retests with external testers.
• Build and run vulnerability management across code, dependencies, hosts and third-party software, with remediation SLAs tracked to closure.
• Review designs and pull requests with engineers, and build security into our delivery pipeline.
Detection and response
• Own security alerting and keep it useful rather than noisy.
• Lead incident response end to end: triage, containment, investigation, root cause and the write-up for management and regulators.
• Run phishing awareness, tabletop exercises and restore tests.
Governance and compliance
• Run our ISMS: control evidence, risk register, policies, vendor security reviews, access reviews and audit support.
• Turn regulatory requirements (CMA, DFSA, and KSA and UAE data protection law) into practical controls and evidence.
IT (around 20% of your time)
• Run joiner, mover and leaver access: accounts, SSO, app roles, offboarding and data handover.
• Manage company laptops through MDM: enrolment, configuration, encryption and app deployment.
• Administer our identity and collaboration tools, the company password manager and MFA.
• Automate the repetitive parts so IT stays a small slice of the job.
Qualifications & Experience
• 3+ years in security, ideally including time as a penetration tester or security auditor at a pentest firm, security consultancy or compliance platform.
• Hands-on web application, API and cloud penetration testing: you can find and exploit real vulnerabilities, write them up clearly, and work with engineers on the fix.
• Practical security experience on at least one major cloud provider: IAM, network controls and logging.
• Experience with WAF and zero-trust access tooling.
• Strong Linux and networking fundamentals: SSH, TLS, DNS, firewalls and VPNs.
• Comfortable writing automation in Python or Bash, and reviewing application code for security issues (OWASP Top 10).
• Incident response experience, including investigating from raw logs.
• Familiarity with ISO 27001 or SOC 2 controls and producing audit evidence.
• Some experience administering an identity provider and managing devices with an MDM.
• Uses AI tools to work faster and checks their output critically.
• Fluent English, written and spoken.
Skills (Nice-to-Haves)
• Experience in fintech, banking or other regulated financial services, ideally with GCC regulators.
• Certifications such as OSCP, OSWE, CREST, CISSP, CCSP, a cloud provider security certification, or ISO 27001 Lead Implementer or Lead Auditor.
• Container security, infrastructure as code and CI/CD security.
• Knowledge of the Saudi and UAE personal data protection laws.
• Red-team experience, published CVEs, bug bounty findings or CTF results.
• Experience as the first or only security engineer at a startup.
• Arabic is a plus.
erad is a Sharia-compliant fintech providing SME financing in Saudi Arabia and the UAE, licensed by the CMA in KSA and the DFSA in the UAE. We are hiring a Cybersecurity Engineer to own the security of our platform, our people and our devices. You will report to the CTO and work with a fully distributed engineering team that ships with AI-assisted tooling every day. We especially want to hear from penetration testers and security auditors who are ready to move from finding the issues to owning the fixes.
What You'll Do
Security engineering and testing
• Own the security posture of our cloud environment: identity and access, network exposure, host hardening and patching, secrets, and logging coverage.
• Test our own products the way an attacker would: regular internal pentests of our web apps and APIs, plus scoping and retests with external testers.
• Build and run vulnerability management across code, dependencies, hosts and third-party software, with remediation SLAs tracked to closure.
• Review designs and pull requests with engineers, and build security into our delivery pipeline.
Detection and response
• Own security alerting and keep it useful rather than noisy.
• Lead incident response end to end: triage, containment, investigation, root cause and the write-up for management and regulators.
• Run phishing awareness, tabletop exercises and restore tests.
Governance and compliance
• Run our ISMS: control evidence, risk register, policies, vendor security reviews, access reviews and audit support.
• Turn regulatory requirements (CMA, DFSA, and KSA and UAE data protection law) into practical controls and evidence.
IT (around 20% of your time)
• Run joiner, mover and leaver access: accounts, SSO, app roles, offboarding and data handover.
• Manage company laptops through MDM: enrolment, configuration, encryption and app deployment.
• Administer our identity and collaboration tools, the company password manager and MFA.
• Automate the repetitive parts so IT stays a small slice of the job.
Qualifications & Experience
• 3+ years in security, ideally including time as a penetration tester or security auditor at a pentest firm, security consultancy or compliance platform.
• Hands-on web application, API and cloud penetration testing: you can find and exploit real vulnerabilities, write them up clearly, and work with engineers on the fix.
• Practical security experience on at least one major cloud provider: IAM, network controls and logging.
• Experience with WAF and zero-trust access tooling.
• Strong Linux and networking fundamentals: SSH, TLS, DNS, firewalls and VPNs.
• Comfortable writing automation in Python or Bash, and reviewing application code for security issues (OWASP Top 10).
• Incident response experience, including investigating from raw logs.
• Familiarity with ISO 27001 or SOC 2 controls and producing audit evidence.
• Some experience administering an identity provider and managing devices with an MDM.
• Uses AI tools to work faster and checks their output critically.
• Fluent English, written and spoken.
Skills (Nice-to-Haves)
• Experience in fintech, banking or other regulated financial services, ideally with GCC regulators.
• Certifications such as OSCP, OSWE, CREST, CISSP, CCSP, a cloud provider security certification, or ISO 27001 Lead Implementer or Lead Auditor.
• Container security, infrastructure as code and CI/CD security.
• Knowledge of the Saudi and UAE personal data protection laws.
• Red-team experience, published CVEs, bug bounty findings or CTF results.
• Experience as the first or only security engineer at a startup.
• Arabic is a plus.