# Cybersecurity Engineer (Cloud & IT) - Remote

**Company:** [erad](https://zerogtalent.com/frontier-companies/erad)
**Location:** Remote
**Work mode:** Remote
**Seniority:** Mid
**Employment type:** Full Time
**Salary:** USD 2500–2500/mo
**Category:** Security
**Listed:** 2026-11-03

[View and apply on Zero G Talent](https://zerogtalent.com/frontier-jobs/erad/cybersecurity-engineer-cloud-it-remote-120168)

## What you'll do

- Own cloud security posture: IAM, network exposure, host hardening, secrets, logging
- Run internal pentests of web apps and APIs
- Build and run vulnerability management with remediation SLAs
- Lead incident response end to end
- Run ISMS: control evidence, risk register, policies, audits

## What you need

- 3+ yrs in security
- Web, API and cloud penetration testing
- Cloud provider experience: IAM, network controls, logging
- Linux and networking: SSH, TLS, DNS, firewalls, VPNs
- Python or Bash automation; OWASP Top 10 code review

## Job description

### About the Role

erad is a Sharia-compliant fintech providing SME financing in Saudi Arabia and the UAE, licensed by the CMA in KSA and the DFSA in the UAE. We are hiring a Cybersecurity Engineer to own the security of our platform, our people and our devices. You will report to the CTO and work with a fully distributed engineering team that ships with AI-assisted tooling every day. We especially want to hear from penetration testers and security auditors who are ready to move from finding the issues to owning the fixes.

### What You'll Do

**Security engineering and testing**

-   Own the security posture of our cloud environment: identity and access, network exposure, host hardening and patching, secrets, and logging coverage.
-   Test our own products the way an attacker would: regular internal pentests of our web apps and APIs, plus scoping and retests with external testers.
-   Build and run vulnerability management across code, dependencies, hosts and third-party software, with remediation SLAs tracked to closure.
-   Review designs and pull requests with engineers, and build security into our delivery pipeline.

**Detection and response**

-   Own security alerting and keep it useful rather than noisy.
-   Lead incident response end to end: triage, containment, investigation, root cause and the write-up for management and regulators.
-   Run phishing awareness, tabletop exercises and restore tests.

**Governance and compliance**

-   Run our ISMS: control evidence, risk register, policies, vendor security reviews, access reviews and audit support.
-   Turn regulatory requirements (CMA, DFSA, and KSA and UAE data protection law) into practical controls and evidence.

**IT (around 20% of your time)**

-   Run joiner, mover and leaver access: accounts, SSO, app roles, offboarding and data handover.
-   Manage company laptops through MDM: enrolment, configuration, encryption and app deployment.
-   Administer our identity and collaboration tools, the company password manager and MFA.
-   Automate the repetitive parts so IT stays a small slice of the job.

### Qualifications & Experience

-   3+ years in security, ideally including time as a penetration tester or security auditor at a pentest firm, security consultancy or compliance platform.
-   Hands-on web application, API and cloud penetration testing: you can find and exploit real vulnerabilities, write them up clearly, and work with engineers on the fix.
-   Practical security experience on at least one major cloud provider: IAM, network controls and logging.
-   Experience with WAF and zero-trust access tooling.
-   Strong Linux and networking fundamentals: SSH, TLS, DNS, firewalls and VPNs.
-   Comfortable writing automation in Python or Bash, and reviewing application code for security issues (OWASP Top 10).
-   Incident response experience, including investigating from raw logs.
-   Familiarity with ISO 27001 or SOC 2 controls and producing audit evidence.
-   Some experience administering an identity provider and managing devices with an MDM.
-   Uses AI tools to work faster and checks their output critically.
-   Fluent English, written and spoken.

### Skills (Nice-to-Haves)

-   Experience in fintech, banking or other regulated financial services, ideally with GCC regulators.
-   Certifications such as OSCP, OSWE, CREST, CISSP, CCSP, a cloud provider security certification, or ISO 27001 Lead Implementer or Lead Auditor.
-   Container security, infrastructure as code and CI/CD security.
-   Knowledge of the Saudi and UAE personal data protection laws.
-   Red-team experience, published CVEs, bug bounty findings or CTF results.
-   Experience as the first or only security engineer at a startup.
-   Arabic is a plus.

---
*Source: [Zero G Talent](https://zerogtalent.com), the job board for space, defense, AI, robotics and frontier-tech companies.*