Chief Information Security Officer

The CISO owns the company's security strategy end to end. You will protect our platforms, products, data and people; keep us compliant with Egyptian and international requirements; and act as a trusted, visible security voice with clients, regulators and the market.

Strategy and leadership

•      Set and deliver a 3-year information security strategy and roadmap aligned with business growth.

•      Build, lead and retain a high-performing security organization; develop successors and local talent.

•      Own the security budget and justify investments in clear business and risk terms.

•      Report security posture, risks and incidents to the CEO and Board at least quarterly.

Governance, risk and compliance

•      Own the information security management system (ISMS) and maintain ISO/IEC 27001 certification.

•      Ensure compliance with Egyptian requirements, including the Personal Data Protection Law (Law No. 151 of 2020) and its executive regulations, the Anti-Cyber and Information Technology Crimes Law (Law No. 175 of 2018), and sector rules from the Central Bank of Egypt, NTRA and the Supreme Cybersecurity Council where they apply.

•      Align controls with international frameworks: NIST CSF, CIS Controls, PCI DSS, SOC 2, GDPR (for EU clients) and GCC requirements (e.g. NCA ECC, SAMA) for regional business.

•      Run enterprise security risk assessments, third-party/vendor risk and policy management.

•      Lead internal and external audits and close findings on time.

Security operations and incident response

•      Oversee a 24/7 Security Operations Center (in-house or hybrid with MSSP): monitoring, threat detection and threat intelligence.

•      Own the incident response plan; lead the response to major incidents, including regulator and client notification.

•      Run vulnerability management, penetration testing and red/purple team exercises.

•      Own business continuity and disaster recovery readiness with IT, tested at least annually.

Architecture, cloud and product security

•      Set security architecture standards across on-premise, cloud (AWS, Azure, GCP and local cloud) and hybrid environments.

•      Embed secure SDLC and DevSecOps in engineering: threat modelling, code review, SAST/DAST, software supply-chain security.

•      Drive Zero Trust, identity and access management (IAM/PAM), data protection and encryption programs.

Clients, business and market

•      Support sales and pre-sales: client security questionnaires, due diligence, RFP security sections and executive briefings.

•      Advise on the security of products and managed services the company sells.

•      Represent the company with regulators, partners, industry forums and the media.

Must have

•      Bachelor's degree in Computer Science, Computer Engineering, Information Security or a related field.

•      15+ years in IT and information security, including 7+ years in senior security leadership (Head of Security, Deputy CISO or CISO).

•      Proven record building and running a security program and SOC in a technology, software, telecom or financial services company.

•      Hands-on background in at least two of: security architecture, SOC/incident response, offensive security, cloud security, application security.

•      Led ISO/IEC 27001 certification or major regulatory audits end to end.

•      Strong working knowledge of Egyptian data protection and cybercrime law and the regulatory landscape (CBE, NTRA).

•      Experience managing a team of 15+ security professionals and a significant budget.

•      Fluent Arabic and English, written and spoken, with Board-level presentation skills.

Certifications

•      Required: CISSP or CISM.

•      Preferred: CISA, CRISC, CCSP, ISO 27001 Lead Implementer/Auditor, OSCP, GIAC (GCIH, GSLC).

Nice to have

•      Master's degree or MBA.

•      Experience with government or critical-infrastructure clients.

•      Regional exposure to GCC and African markets and their regulators.

•      Experience in a company that sells cybersecurity services or products (MSSP, SOC-as-a-service, security software).

•      Public profile: conference talks, publications, industry or community leadership.