Senior Manager Information Security

About the role

Tabby is seeking a Senior Manager Information Security to lead and shape its security function across strategic and technical domains. You will manage a team of security professionals and own key programmes in cloud security, architecture, application security, vulnerability management, threat detection and incident response.

Key responsibilities

• Lead hands‑on security architecture reviews and technical security assessments for cloud, infrastructure and product initiatives.
• Design and implement security controls in GCP and AWS, including IAM, CSPM and cloud‑native protections.
• Drive Secure SDLC/DevSecOps practices such as SAST, DAST, SCA and container security.
• Oversee vulnerability management, penetration testing, VAPT and red/purple‑team engagements.
• Develop and refine SIEM use cases, threat detection and security monitoring.
• Lead complex security incident investigations and response activities.
• Automate security processes and build custom tooling as needed.
• Establish technical standards, best practices and operating procedures.
• Mentor, manage and develop a team of security engineers and analysts.
• Collaborate with Engineering, Infrastructure, Product, IT, Legal and Compliance to embed security throughout the organization.

Required profile

• Proven senior leadership experience in information security or cyber security.
• Deep expertise in cloud security, security architecture, VAPT, application security and defensive security.
• Experience managing cross‑functional security programmes in a regulated FinTech or banking environment.
• Strong knowledge of GCP, AWS, IAM, CSPM, SIEM, EDR/XDR and vulnerability management tools.
• Familiarity with CBUAE, UAE PDPL, PCI‑DSS, ISO 27001 and SOC 2 compliance frameworks.
• Relevant certifications such as CISSP, CISM, OSCP are preferred.

Required skills

• GCP
• AWS
• IAM
• CSPM
• SAST
• DAST
• SCA
• Container security
• SIEM
• EDR/XDR
• Vulnerability management
• Penetration testing
• Red‑team / Purple‑team engagements
• Threat hunting
• Incident response
• Security architecture
• Threat modelling