Security Manager

About the role

We are looking for a Security Manager to lead the protection of our fintech platform, overseeing security operations, risk management and fraud prevention across the Orange Money ecosystem.

Key responsibilities

• Manage security operations with cloud providers and internal teams, including monitoring, logging, alerting and incident response.
• Operate and govern security technologies such as PAM, WAF, IPS, firewalls, authentication systems and VPN, ensuring proper configuration and hardening.
• Control privileged access, enforce least-privilege policies, conduct periodic access reviews and maintain full auditability.
• Identify, assess and mitigate security risks, maintain the risk register and ensure independent assurance of controls.
• Apply Security-by-Design and Privacy-by-Design principles throughout project lifecycles.
• Oversee secure coding practices, code reviews, vulnerability scanning, penetration testing and remediation.
• Lead fraud monitoring, detection and investigation capabilities to protect customers and transactions.
• Govern vulnerability management, patching cycles and coordinate security audits and penetration tests.
• Direct incident detection, containment, root-cause analysis and regulator engagement.

Required profile

• Bachelor’s degree in Cybersecurity, Computer Engineering or Computer Science (Master’s a plus).
• 7-10 years of experience in information security, with at least 3 years in security management.
• Proven experience in fintech, digital payments or banking environments.
• Strong knowledge of Central Bank of Jordan requirements, PCI DSS, ISO 27001 and data-protection regulations.
• Relevant certifications such as CISSP, CISM, CEH, ISO 27001 Lead Implementer/Auditor or PCI ISA are strongly preferred.

Required skills

• Privileged Access Management (PAM)
• Web Application Firewall (WAF)
• Intrusion Prevention System (IPS)
• Firewalls and VPN technologies
• Authentication and access-control solutions
• Fortinet products
• Vulnerability management and patching
• Penetration testing and secure code review
• Incident response and crisis management
• Fraud monitoring and investigation
• Regulatory compliance frameworks (PCI DSS, ISO 27001, PDPL)