Head of Security

About the role

In this role, you will define and implement security strategies for Airtm's financial platform, focusing on risk management and incident response. You will be responsible for building a security team and embedding security practices into the software development lifecycle.

Airtm operates in the financial infrastructure space, empowering digital entrepreneurs in emerging markets. Your success will be measured by the effectiveness of security measures you establish, the resilience of the system against threats, and the overall safety of financial transactions.

Skills that matter here

• TypeScript: You will need to read and review TypeScript code to ensure security standards are met.
• Node.js: Understanding Node.js is essential for assessing application security within the platform.
• Kubernetes: Kubernetes security knowledge is crucial for hardening the infrastructure.
• AWS: You will oversee AWS security practices to protect cloud resources.
• React: While not the primary focus, familiarity with React can help in application security assessments.

Who this role suits

• A candidate with a strong background in information security, particularly in fintech or crypto sectors.
• Someone who thrives under pressure and can make quick decisions with limited information.
• An effective communicator who can articulate risks to various stakeholders, including engineers and executives.
• A leader who enjoys mentoring and building teams, fostering a culture of security awareness.

From the employer

Key Responsibilities

• Security Strategy & Roadmap: Define and own a risk-based security strategy for a financial platform; prioritize investment by real threat and business impact, and report on posture to executive leadership and the board.
• Incident Response: Own detection, response, and recovery for security incidents; maintain runbooks, lead incidents and post-incident reviews, coordinate with forensics, legal, and communications, and turn every incident into lasting improvements.
• Application Security: Embed security into the SDLC with threat modeling, secure design reviews, SAST/DAST/dependency scanning, and secure coding standards that engineers actually adopt.
• Cloud & Infrastructure Security: Partner with Infrastructure to harden AWS, Kubernetes, networking, and CI/CD pipelines; own IAM and least-privilege access, secrets management, and security in Terraform and GitOps workflows.
• Detection & Monitoring: Build the detection and alerting capability that finds malicious activity early, across application, infrastructure, and access logs, and tune it to keep signal high.
• Crypto & Key Security: Own the security model for key management, wallet and custody operations, and the blockchain integrations our payment rails depend on.
• Fraud & Account Security Collaboration: Work with Product and Risk teams on account takeover, abuse, and transaction-level controls.
• AI Security: Define guardrails for AI coding tools and for AI agents and LLM pipelines we build or deploy, including agent permissions, prompt injection, data exposure, and tool-access boundaries.
• Compliance & Assurance: Own our security compliance program (SOC 2 and related frameworks), audits, and customer and partner security questionnaires, aiming to make compliance a byproduct of good engineering rather than a separate burden.
• Vendor & Third-Party Risk: Run vendor risk assessments and security due diligence for partners, investors, and acquirers.
• Vulnerability & Patch Management: Establish clear SLAs by severity and keep remediation moving across teams without becoming a bottleneck.
• Team Building & Mentorship: Hire, grow, and lead security engineers; build a security champions network inside product teams; raise the security bar across all of engineering.
• On-Call & Escalation: Participate in and help shape the security escalation path for production incidents.

Required Qualifications

• 8+ years of experience in information or application security, including 3+ years leading security teams or functions.
• Demonstrated experience leading incident response for real, high-stakes incidents, including coordination with external forensics and counsel.
• Strong knowledge of AWS security and Kubernetes security (IAM, network segmentation, RBAC, secrets management, container and image security).
• Hands-on experience with application security in a microservices environment: threat modeling, secure code review, and dependency and supply-chain risk.
• Experience building detection and monitoring capabilities (SIEM, log analysis, alerting; Datadog or similar).
• Experience owning or leading a compliance program such as SOC 2, ISO 27001, or PCI-DSS, including audit cycles.
• Ability to read and review TypeScript/Node.js code and infrastructure-as-code (Terraform); you don't need to be a full-time developer, but you need to be credible with engineers.
• Experience securing CI/CD pipelines and software supply chains.
• Hands-on experience with AI-assisted tools (e.g., Claude Code, Cursor, GitHub Copilot) for security work, and a clear point of view on the risks of AI-generated code and agentic systems.
• Strong communication skills; able to explain risk to engineers, executives, regulators, and customers, and to write policies and runbooks people follow.
• Sound judgment under pressure; able to make fast, defensible calls with incomplete information.

Nice to Have

• Background in fintech, payments, remittance, or crypto environments, especially key management, custody, and blockchain security.
• Experience with fraud, account takeover, and abuse prevention.
• Experience securing AI agents and LLM-powered systems in production (prompt injection defenses, tool-permission models, eval and red-teaming approaches).
• Hands-on offensive security experience (penetration testing, red teaming) or running bug bounty programs.
• Experience with cloud-native security tooling (CSPM, runtime protection, policy-as-code such as OPA/Kyverno).
• Familiarity with regulatory requirements for money transmission and financial services across multiple jurisdictions.
• Security certifications (CISSP, CISM, OSCP, AWS Security Specialty).
• Experience supporting investor, buyer, or enterprise due diligence on security posture.
• Experience building a security function from a small base in a fast-growing engineering org.