Head of Security
Job Fit Check
Base Career helps you apply smarter for this job.
Key skills for this role
About the Role
As Head of Security at Salla, you are the most senior security authority at Salla. You set the strategy, build the team, and own the controls that keep our platform, our people,.
Key Skills for This Role
Responsibilities
- Own and evolve the enterprise security strategy, roadmap, and operating model across cloud, network, endpoint, physical, and GRC.
- Act as principal security advisor to executive team and board on cyber risk posture and investment priorities.
- Lead cloud security across the platform including landing zone hardening, network segmentation, secrets management, and workload protection.
- Own network security architecture including edge protection, DDoS mitigation, WAF, segmentation, and zero trust network access.
- Lead endpoint protection across corporate and engineering fleets including EDR/XDR, device hardening, and vulnerability management.
- Own physical security for offices and facilities including access control, CCTV, and visitor management.
- Lead IAM strategy including SSO, MFA, PAM, and least privilege enforcement.
- Build and run security operations capability including SIEM, detection engineering, threat intelligence, and incident response.
- Own GRC function, enterprise risk register, and lead certification/audit programs.
- Establish and run third party risk program including security due diligence and continuous monitoring.
- Build company wide security awareness, training, and phishing simulation program.
- Lead, mentor, and grow a multidisciplinary security organization.
Requirements
- Experience as senior security authority setting strategy and building teams
- Deep expertise in cloud security (AWS preferred), network security, endpoint security, and physical security
- Experience with IAM, zero trust architecture, and security operations
- Knowledge of GRC frameworks including ISO 27001, SOC 2, PCI DSS, NCA, SAMA, and Saudi PDPL
- Ability to communicate security posture to executive team and board
- Saudi nationality required (as per job posting)
Full Job Posting
Role Overview
- As Head of Security at Salla, you are the most senior security authority at Salla. You set the strategy, build the team, and own the controls that keep our platform, our people, and our merchants safe.
- You translate risk into business language for the executive team and the Board, and you make security a competitive advantage rather than a constraint.
- You will lead end to end across every security domain and represent Salla's security posture to auditors, regulators, partners, and customers.
Security Strategy & Leadership
- Own and evolve the enterprise security strategy, roadmap, and operating model across cloud, network, endpoint, physical, and GRC, aligned to Salla's growth and public listing readiness.
- Act as the organization's principal security advisor; brief the executive team and the Board on cyber risk posture, investment priorities, and regulatory exposure.
- Define and steward the security budget, headcount plan, and tooling portfolio; drive measurable return on security investment.
- Establish security KPIs, OKRs, and a metrics driven reporting cadence for leadership and audit committees.
Cloud Security
- Lead cloud security across the platform, including landing zone hardening, network segmentation, secrets management, and workload protection (AWS strongly preferred).
- Govern Infrastructure as Code security, container and Kubernetes security (image scanning, admission control, runtime protection), and CI/CD pipeline integrity.
- Drive Cloud Security Posture Management, workload protection, and continuous compliance against recognized cloud control frameworks and CIS benchmarks.
- Partner with SRE and Platform Engineering to embed secure by default guardrails that protect velocity rather than slow it.
Network Security
- Own network security architecture, including edge protection, DDoS mitigation, web application firewall, segmentation, and zero trust network access.
- Govern the CDN and edge security stack, bot management, rate limiting, and origin lockdown for high traffic, merchant facing services.
- Oversee secure connectivity, private connectivity, VPN, and DNS security.
Endpoint Security
- Lead endpoint protection across corporate and engineering fleets, including EDR/XDR, device hardening, mobile device management, and disk encryption.
- Run a continuous vulnerability and patch management program with clear remediation SLAs.
- Define and enforce endpoint baselines and data loss prevention controls.
Physical & Facility Security
- Own physical security for Salla's offices and facilities in Makkah and other sites, including access control, CCTV, visitor management, and environmental controls.
- Align physical and logical access policies; govern physical access to sensitive areas and equipment.
- Coordinate with Facilities, HR, and local authorities on safety, badging, and on site incident response.
Identity & Access Management (Zero Trust)
- Lead IAM strategy across cloud and corporate systems, including single sign on, multi factor authentication, privileged access management, and least privilege enforcement.
- Automate joiner, mover, and leaver workflows and run periodic access recertification.
- Advance the organization toward a mature zero trust architecture.
Security Operations & Incident Response
- Build and run the security operations capability, including SIEM, detection engineering, threat intelligence, and continuous monitoring.
- Own the incident response lifecycle from preparation through detection, containment, eradication, recovery, and blameless post incident review.
- Lead tabletop exercises, red and purple teaming, and breach readiness drills; maintain crisis communication and breach notification playbooks.
Governance, Risk & Compliance (GRC)
- Own the GRC function and the enterprise risk register; run the risk assessment and treatment lifecycle.
- Lead certification and audit programs spanning ISO/IEC 27001, SOC 2, and PCI DSS, with alignment to the NCA Essential Cybersecurity Controls and Cloud Cybersecurity Controls, and to the SAMA Cyber Security Framework where applicable.
- Own data protection and privacy compliance under the Saudi Personal Data Protection Law and SDAIA requirements, including data inventories, processing agreements, and cross border transfer controls.
- Prepare Salla's security and IT governance posture for Tadawul listing, including controls maturity, evidence collection, and auditor readiness.
- Author, ratify, and maintain the full lifecycle of security policies, standards, and procedures.
Third Party & Vendor Risk
- Establish and run the third party risk program, including security due diligence, contractual security terms, and continuous monitoring of critical suppliers.
- Embed security requirements into procurement and vendor onboarding.
Apply for this job in 1 click
Skip the repetitive application forms
Install the Base Career Chrome Extension and autofill job applications across major job boards with your profile.
Trusted by over 500,000 job seekers on Base Career
More from this employer
More jobs at Salla
Senior Sales Executive
Jeddah, KSA
What you'll do: Prospect, qualify, and close new merchant accounts across SMB and enterprise segments in your assigned verticals - self-sourcing your pipeline rather than waitin...
Lifecycle Marketing Manager
Jeddah, KSA
What you'll own The full lifecycle, onboarding to engagement to retention to win-back, end to end Building Mahally's Braze journeys from the ground up: flows, canvases, and trig...
Lifecycle Marketing Manager - Mahally
Riyadh, KSA
Mahally (by Salla) is seeking a Lifecycle Marketing Manager to own the full customer lifecycle from onboarding to retention. The role involves building Braze journeys, behavioral segmentation, A/B testing, and CRM report
Lifecycle Marketing Manager - Mahally
Jiddah, KSA
Mahally (by Salla) seeks a Lifecycle Marketing Manager to build and own the full customer lifecycle using Braze, SQL, and behavioral segmentation. The role involves building automated journeys, A/B testing, and driving r
Senior Sales Executive
Jiddah, KSA
Salla is looking for a Senior Sales Executive to prospect, qualify, and close new merchant accounts across SMB and enterprise segments in Saudi Arabia. The role involves full-cycle sales, pipeline management, and tailore
Engineering Manager - Enterprise Solutions & Delivery
Riyadh, KSA
Salla seeks an Engineering Manager to lead the Enterprise Solutions team, managing engineers delivering custom enterprise-grade services for premium merchants. The role involves team leadership, delivery management, and
Engineering Manager - Enterprise
Saudi Arabia, KSA
Lead the Enterprise Solutions team, managing engineers, ensuring high-quality technical delivery, and adapting services for global markets while fostering client success.
Engineering Manager - Enterprise
Mecca, KSA
Salla seeks an Engineering Manager to lead the Enterprise Solutions team, delivering custom enterprise-grade services for premium merchants. You will manage engineers, oversee technical delivery, and act as a bridge betw
Senior Sales Executive
Jeddah, KSA
Lifecycle Marketing Manager
Jeddah, KSA
Lifecycle Marketing Manager - Mahally
Riyadh, KSA
Lifecycle Marketing Manager - Mahally
Jiddah, KSA
Senior Sales Executive
Jiddah, KSA
Engineering Manager - Enterprise Solutions & Delivery
Riyadh, KSA
Engineering Manager - Enterprise
Saudi Arabia, KSA
Engineering Manager - Enterprise
Mecca, KSA