A
Head of security
Contract type
Ongoing
Work mode
Remote
Experience
Senior · 8+ years
Job description
Head of Security at Airtm, reporting to the VP of Engineering, responsible for building and leading security across a cross-border payments platform. The role owns security strategy, incident response, application and cloud security, compliance, and AI security while staying hands-on.
At a glance
- Work mode
- Remote
What you'll do
- Define and own a risk-based security strategy for a financial platform; prioritize investment by real threat and business impact, and report on posture to executive leadership and the board
- Own detection, response, and recovery for security incidents; maintain runbooks, lead incidents and post-incident reviews, coordinate with forensics, legal, and communications, and turn every incident into lasting improvements
- Embed security into the SDLC with threat modeling, secure design reviews, SAST/DAST/dependency scanning, and secure coding standards that engineers actually adopt
- Partner with Infrastructure to harden AWS, Kubernetes, networking, and CI/CD pipelines; own IAM and least-privilege access, secrets management, and security in Terraform and GitOps workflows
- Build the detection and alerting capability that finds malicious activity early, across application, infrastructure, and access logs, and tune it to keep signal high
- Own the security model for key management, wallet and custody operations, and the blockchain integrations our payment rails depend on
- Work with Product and Risk teams on account takeover, abuse, and transaction-level controls
- Define guardrails for AI coding tools and for AI agents and LLM pipelines we build or deploy, including agent permissions, prompt injection, data exposure, and tool-access boundaries
- Own our security compliance program (SOC 2 and related frameworks), audits, and customer and partner security questionnaires, aiming to make compliance a byproduct of good engineering rather than a separate burden
- Run vendor risk assessments and security due diligence for partners, investors, and acquirers
- Establish clear SLAs by severity and keep remediation moving across teams without becoming a bottleneck
- Hire, grow, and lead security engineers; build a security champions network inside product teams; raise the security bar across all of engineering
- Participate in and help shape the security escalation path for production incidents
What we're looking for
- 8+ years of experience in information or application security, including 3+ years leading security teams or functions
- Demonstrated experience leading incident response for real, high-stakes incidents, including coordination with external forensics and counsel
- Strong knowledge of AWS security and Kubernetes security (IAM, network segmentation, RBAC, secrets management, container and image security)
- Hands-on experience with application security in a microservices environment: threat modeling, secure code review, and dependency and supply-chain risk
- Experience building detection and monitoring capabilities (SIEM, log analysis, alerting; Datadog or similar)
- Experience owning or leading a compliance program such as SOC 2, ISO 27001, or PCI-DSS, including audit cycles
- Ability to read and review TypeScript/Node.js code and infrastructure-as-code (Terraform); you don't need to be a full-time developer, but you need to be credible with engineers
- Experience securing CI/CD pipelines and software supply chains
- Hands-on experience with AI-assisted tools (e.g., Claude Code, Cursor, GitHub Copilot) for security work, and a clear point of view on the risks of AI-generated code and agentic systems
- Strong communication skills; able to explain risk to engineers, executives, regulators, and customers, and to write policies and runbooks people follow
- Sound judgment under pressure; able to make fast, defensible calls with incomplete information
Nice to have
- Background in fintech, payments, remittance, or crypto environments, especially key management, custody, and blockchain security
- Experience with fraud, account takeover, and abuse prevention
- Experience securing AI agents and LLM-powered systems in production (prompt injection defenses, tool-permission models, eval and red-teaming approaches)
- Hands-on offensive security experience (penetration testing, red teaming) or running bug bounty programs
- Experience with cloud-native security tooling (CSPM, runtime protection, policy-as-code such as OPA/Kyverno)
- Familiarity with regulatory requirements for money transmission and financial services across multiple jurisdictions
- Security certifications (CISSP, CISM, OSCP, AWS Security Specialty)
- Experience supporting investor, buyer, or enterprise due diligence on security posture
- Experience building a security function from a small base in a fast-growing engineering org
Apply
Direct apply at Airtm
Opens the job posting at Airtm
About Airtm
Building the future of the online-work economy
Airtm is a financial-infrastructure company building a swift and comprehensive financial platform that facilitates low-value cross-border payments and local cash-outs. As pioneers in stablecoin-payment infrastructure, Airtm has built the most advanced cross-border payment system available on the market, and is building the infrastructure the online-work economy needs to thrive.
Mission
Empower the world's growing number of Digital Entrepreneurs in the Global South, giving them the financial freedom to thrive.
Key facts
- Financial infrastructure / cross-border payments
- Pioneers in stablecoin-payment infrastructure
- Built the most advanced cross-border payment system available on the market
- Stack is TypeScript/Node.js microservices on Kubernetes (AWS) with React front ends, organized into autonomous product teams
- AI-assisted development is core to how we build
What they value
- Ownership
- Security as a partnership with engineers
- Good judgment about risk
- Improving the team around them
- Collaborating across boundaries
- Rigor in adopting AI safely