Tanami تعلن عن وظيفة مسؤول أمن المعلومات في الرياض

About Tanami

Tanami is reshaping access to private markets in the Middle East and beyond. We're building the core systems and end-to-end experiences that make private markets accessible - from secure onboarding and transaction processing to portfolio management, money movement, and reporting.

We're a small, high-ownership team building our own platform from the infrastructure up.

The Role

We're looking for an Information Security Officer to own security across Tanami - the standards we hold ourselves to, the evidence behind them, and the relationship with our regulators. You'll report directly to the Chief Product & Technology Officer, and you'll be our voice on cyber risk with the leadership team.

You'll set the bar and verify it's met; our engineering team builds against it. You'll hold our security tooling and visibility across the estate.

What You'll Do

• Own our information security programme - the control set, the policies, and the evidence that proves each control works
• Own the information security risk register: identify, assess, track, and report
• Lead regulatory engagement on cyber matters, including inspections, submissions, and correspondence
• Run the annual penetration testing cycle - scoping, third-party selection, findings triage, and verification of closure
• Define hardening and configuration baselines across our cloud and productivity estate
• Administer our security tooling - vulnerability management, incident response, and cloud security services
• Own incident response playbooks, keep them tested, and act as incident commander when something happens
• Run vendor and third-party security risk assessments, including our platform and fintech partners
• Report on control status and security maturity to leadership

What We're Looking For

• Information security ownership in regulated financial services - you've held the security programme at a licensed firm, or advised one closely enough to have carried the consequences
• An assurance mindset - you're as comfortable verifying and evidencing a control as designing one
• Framework fluency - you work naturally from a recognised control framework (NIST CSF, ISO 27001, SOC 2, CIS) rather than from a checklist someone handed you
• Cloud literacy with real depth - enough AWS, GCP, and Microsoft 365 to challenge an engineer's answer and know when it doesn't hold up
• Evidence discipline - you've produced audit and regulatory evidence that survived scrutiny, and you know the difference between a control that exists and a control you can prove
• Able to hold a position - including with senior engineering stakeholders, and able to explain the reasoning to people who aren't technical
• Startup DNA - high autonomy, comfortable with a blank page, biased to action, no team beneath you on day one

Nice to Have

• Multi-jurisdiction experience - you've run a security programme under more than one regulator and know how to satisfy both without building two of everything
• CISM, CRISC, CISSP or equivalent
• Experience as the first security hire somewhere - you built the function rather than inherited it
• Exposure to cloud-native architectures and mobile application security
• Private-markets, investment-platform, or securities domain experience

Location & Work Style

This role is based in Riyadh and is open to Saudi nationals.

You'll work closely with our technology leadership and with engineers across the region, with meaningful daily overlap.