Head of Reliability, Trust & Security

Job description

The Role: Trust in What We Run Trust, reliability and security start with you. You build an organisation where security, reliability and compliance are the default path. You own the employer’s environment and the standards that everyone building in it works to, and you build the function around you as the company grows, across both our internal operations and our customer engagements. What You Will Own • Environment ownership: the employer owns its cloud accounts, identity, keys and source code. Everyone who builds in the environment, internal or external, works under the employer’s access controls, and a clean separation path exists for any partner. • Security: Security engineering, application and cloud security, identity and access, detection and response, and vulnerability management. • Resilience & reliability: Incident management, disaster recovery and business continuity. You define the availability, recovery and observability standards our engineers and partners build to, and verify they are met. • Trust & compliance: Governance, security, and privacy compliance, anchored primarily in Saudi regulatory standards (PDPL, NCA ECC-2:2024, NDMO data residency regulations, and SDAIA guidelines). GDPR serves as our global baseline for privacy, with SOC 2 implemented strictly on a customer-demand basis. Encompasses audit readiness, enterprise risk management, third-party risk oversight, and customer trust assurance. • Data & secure channels: Where the employer’s own data and customer data live: classification, segregation, encryption and retention across the whole environment, and secure file exchange and communication channels for sensitive information, internally and with customers. • Regulator & customer liaison: The named the employer contact for NCA and for SDAIA/NDMO. Security questionnaires, contractual security and residency clauses, and our customer-facing trust posture. Key Responsibilities • Strategy & leadership: Define and own a multi-year strategy and roadmap, built for scale, across infrastructure, security, resilience and trust, tied to business goals. Lead this agenda internally and externally. Act as the accountable executive for security and availability, reporting risk posture and progress to the executive team and the board. Report to the Managing Director and work closely with the Chief Operating Officer. Sit on the Crisis Management Team and lead the technical and data-protection workstream in any incident. Build the certifications and policies that make the employer known, internally and externally, as a highly reliable and highly trusted organisation for our employees, partners and customers, operating to the highest security standards. • Security: Lead a security programme built on zero-trust principles, covering cloud, application, identity, data and endpoint security across the corporate environment and the products and systems built by our engineers, our partners and our customers. Embed security into the software lifecycle: shift-left, secure by default and supply-chain security. Own threat detection, incident response and vulnerability management, including security for AI and LLM-powered features, and AI data governance: AI data-use rules, KSA residency for AI processing and approval of AI use cases. Build the systems and processes that prevent incidents and read signals of weakness early. Own disaster recovery and business continuity plans, with regular tested exercises. Lead the response to major incidents and communicate clearly with customers and leadership. • Trust & compliance: Achieve and maintain the certifications and regulatory compliance our markets require: NCA ECC-2:2024, PDPL and NDMO residency first, with ISO 27001 as the international anchor. Run audits, customer security reviews and a public trust centre, and own the responsible disclosure process and the security [ ]. Own enterprise risk management: the risk framework, risk register and risk appetite, with regular reporting to leadership. Manage third-party and vendor risk, and partner with Legal on privacy and data protection. Where We Align AI and Technology First • Cloud depth: You can read, challenge and verify architecture, infrastructure as code and data flows built by others, on a major cloud (AWS, GCP or Azure). • Incidents & continuity: Experience owning major incident response, disaster recovery and business continuity. • Executive communication: You communicate clearly with executives, boards, customers and regulators, and turn technical risk into business decisions. • Influence without authority: You lead and influence virtual teams, holding engineers, partners and customers to security and data standards through clear requirements, review and testing, without direct authority over them. • Builder’s mindset: You favour automation, paved roads and enablement over gatekeeping. • Arabic & English: You work in Arabic and English, and are credible in front of a ministry procurement officer, a regulator and a founder. Strong Advantage • AI security: Experience securing AI and machine-learning systems and LLM-powered products. • Multi-cloud & hybrid: Multi-cloud or hybrid (cloud plus on-premises) experience, including in-Kingdom hosting and sovereign cloud options. Our Values • Customer first: You measure your work by customer outcomes, and prioritise accordingly. • Ownership mentality: You own outcomes end to end. When something breaks or stalls, you treat it as yours to fix. • Clear communicator: You explain complex systems simply, to operators and executives alike, and make the value of your work visible. • Comfortable with ambiguity: You make progress with incomplete information, partial data and unfamiliar environments, and you enjoy solving problems where there is no structure yet. • Long-term builder: You invest in the employer’s long-term success, bringing field insight back into our strategy and operations. • Builds others: You measure yourself by the people you develop and the capability you build with customers. The Seat • Location: Riyadh, Saudi Arabia • Reports to: The Managing Director • Travel: Time on customer sites across.

Requirements

• Security experience: You have 10+ years in security, hands-on in cloud and data security, with at least one build from zero: the first security hire, or taking a company through its first NCA ECC or ISO 27001 audit.
• Programmes & audits: A track record of building security programmes and leading certification or regulatory audits (NCA ECC, PDPL, ISO 27001), with direct experience of Saudi regulators.
• Regulated sectors: Experience in a regulated sector such as fintech, healthtech or government technology.
• Global data protection: Knowledge of international data-protection rules in the markets we serve, such as GDPR.
• Certification: Relevant certifications such as CISSP, CISM or cloud architect credentials.

Skills