Head of Security📣 Job Ad

About the Head of Security Role at Salla

Salla is seeking a Head of Security to serve as the most senior security authority. This role is responsible for defining security strategy, building the security team, and implementing controls to protect the platform, personnel, and merchants. The Head of Security will translate risk into business terms for executive leadership and the Board, positioning security as a strategic advantage. This position requires comprehensive oversight across all security domains and representation of Salla's security posture to external stakeholders including auditors, regulators, partners, and customers. The role is a full-time position based in Makkah.

Security Strategy and Leadership

The Head of Security will own and advance the enterprise security strategy, roadmap, and operating model, encompassing cloud, network, endpoint, physical, and GRC domains. This strategy must align with Salla's growth objectives and readiness for public listing. Key responsibilities include acting as the principal security advisor, briefing the executive team and Board on cyber risk, investment priorities, and regulatory exposure. The role also involves defining and managing the security budget, headcount plan, and tooling portfolio, with a focus on measurable return on security investment. Establishing security KPIs, OKRs, and a metrics-driven reporting cadence for leadership and audit committees is also a core function.

Domain-Specific Security Oversight

This role demands leadership across multiple security domains:

• Cloud Security: Leading cloud security initiatives, including platform hardening, network segmentation, secrets management, and workload protection, with a preference for AWS. This includes governing Infrastructure-as-Code security, container and Kubernetes security, and CI/CD pipeline integrity, as well as driving Cloud Security Posture Management and continuous compliance.
• Network Security: Owning network security architecture, edge protection, DDoS mitigation, web application firewall, segmentation, and zero-trust network access. This also covers governing CDN and edge security, bot management, and secure connectivity solutions.
• Endpoint Security: Leading endpoint protection for corporate and engineering fleets, including EDR/XDR, device hardening, and mobile device management. A continuous vulnerability and patch management program with clear remediation SLAs is required.
• Physical and Facility Security: Managing physical security for Salla's offices and facilities in Makkah and other locations, including access control, CCTV, and visitor management. Alignment of physical and logical access policies is essential.
• Identity and Access Management (Zero Trust): Leading IAM strategy across cloud and corporate systems, focusing on single sign-on, multi-factor authentication, and privileged access management. The role will drive the organization towards a mature zero-trust architecture.
• Security Operations and Incident Response: Building and operating the security operations capability, including SIEM, detection engineering, and threat intelligence. Ownership of the incident response lifecycle and leading readiness exercises are key.
• Governance, Risk, and Compliance (GRC): Owning the GRC function, managing the enterprise risk register, and leading risk assessment and treatment. This includes managing certification and audit programs (ISO/IEC 27001, SOC 2, PCI DSS) and ensuring compliance with Saudi data protection laws. Preparation for Tadawul listing is also a responsibility.
• Third-Party and Vendor Risk: Establishing and running the third-party risk program, including security due diligence and continuous monitoring of suppliers.
• Security Awareness and Culture: Developing and implementing a company-wide security awareness and training program, fostering a positive security culture.

Team Leadership and Organization Building

The Head of Security will lead, mentor, and grow a multidisciplinary security organization. This includes setting objectives, developing talent, and building a hiring plan to scale the function effectively. Forging strong cross-functional partnerships with Engineering, SRE, IT, Legal, HR, and Finance is critical for success.

Qualifications and Experience

• A minimum of 12 years in information and cyber security, with at least 5 years in senior security leadership roles (*, Head of Security, Director, CISO-track) within SaaS, fintech, or e-commerce organizations.
• Demonstrated ownership of security across multiple domains: cloud, network, endpoint, physical, and GRC.
• Deep hands-on and architectural knowledge of cloud security, particularly AWS, including Kubernetes and modern CI/CD practices.
• Proven experience building and operating security operations and incident response capabilities at scale.
• Strong GRC experience, including ISO 27001, PCI DSS, GDPR, and relevant Saudi regulatory frameworks (NCA ECC and CCC, PDPL and SDAIA; SAMA CSF is a plus).
• Experience leading audits and certifications, ideally including IPO or regulatory-readiness programs.
• Excellent executive communication skills, with the ability to translate technical risk into business and regulatory language for the Board.
• A Bachelor's degree in Computer Science, Engineering, Information Security, or a related field.
• Willingness and eligibility to work on-site in Makkah, Saudi Arabia.