Executive search brief
Kuwait | Senior leadership | Security
Head of Security
build and lead the function
A leading e-commerce company in Kuwait, serving millions of customers across its web and mobile platforms.
LocationKuwait
LevelHead of function
Experience10+ years, 5+ leading
LanguageEnglish. Arabic preferred
We need a security leader who makes sound technical calls personally, builds a lean team supported by trusted partners, and gets engineering and business teams to adopt the changes.
01
Scope of the function
Four capabilities. In-house staff and managed or specialist partners, chosen where each makes sense.
Pillar 1
Governance, Risk and Compliance
Policies, risk management, audit, regulatory and data protection compliance, third-party risk.
Pillar 2
Security Engineering
Application, API, mobile, cloud and identity security, plus secure software delivery.
Pillar 3
Security Operations and Response
Monitoring, detection, digital forensics and incident response, including fraud and abuse incidents.
Pillar 4
Offensive Security
Penetration testing, abuse-case testing of business logic, adversary simulation, control validation.
02
Key responsibilities
Working with Technology leadership.
Strategy and leadership
- Develop and execute a security strategy and roadmap aligned with business priorities, risk exposure and growth.
- Define the operating model, decide what to build in-house and what to source, set hiring priorities and measurable objectives.
- Own the security budget, assess technology investments and manage security vendors.
- Report security performance and significant risks to executive management and board-level governance.
Platform and engineering security
- Oversee security architecture across web, mobile, APIs, cloud, corporate systems and identity platforms.
- Build security into delivery: enforceable code review, secrets management, code and dependency scanning, sign-off on high-risk changes.
- Apply the same discipline to integration, low-code, internal tools and AI-assisted tooling that can reach production data.
- Enforce least-privilege access with regular access reviews. Strengthen bot management, rate limiting, WAF and transport security.
Fraud, abuse and commerce risk
- Work with Fraud, Finance, Customer Service and Product to stop account takeover, credential stuffing, gift card and store credit abuse, promotion and refund abuse, payment fraud.
- Threat-model business logic before launch and test it afterwards.
- Secure the partner and seller ecosystem, including partner portal access and timely offboarding.
Detection, response and assurance
- Make security data searchable and detections tested. Build escalation paths, playbooks and regular exercises.
- Lead major incident response: investigation, containment, recovery, communication and post-incident improvement.
- Direct pentesting and vulnerability management with remediation SLAs and a formal risk acceptance process.
- Lead audit coordination. Ensure compliance with data protection regulations in Kuwait, and PCI DSS for payment flows.
03
Required experience
What we need to see in the first conversation.
- 10+ years in information or cybersecurity, including 5+ years leading security teams or programmes.
- E-commerce, online marketplace, consumer technology or comparable high-volume customer-facing digital business.
- A proven record of building or maturing a security function from an early stage with limited headcount and effective use of partners.
- Hands-on depth in application, API and mobile security, cloud and container security, IAM, vulnerability management and incident response. Able to challenge engineering decisions at design and code level.
- Practical fight against fraud and abuse: account takeover, bots, promotion, gift card and store credit abuse.
- End-to-end management of significant incidents, including forensics and business communication.
- Working knowledge of ISO 27001, NIST CSF, PCI DSS v4.x and data protection requirements in Kuwait.
- Fluent English, spoken and written.
- Proven prioritisation of security investment against operational and commercial needs. Able to present risk to senior management and the board.
- A relevant degree, or equivalent practical experience.
04
Preferred
- Arabic speakers preferred.
- Experience in the Kuwait market and its regulators.
- Public cloud, Kubernetes, modern CI/CD, edge security, bot management, managed detection and response.
- Experience securing AI-enabled tools that can access production.
- Governance experience in a growing business or public-company readiness.
- CISSP, CISM or CCISO. Hands-on certifications such as OSCP are valued.
Apply or refer a candidate
Send your CV, or refer a candidate, to the address below.
Email your CV connect@ameeratalentsolutions.com