Chief Information Security Officer (CISO) Remote (anywhere in United Arab Emirates)

About Us

UMO is a stealth-mode FinTech venture aiming to evolve the way people experience money by building a unified, AI-powered, yet deeply human modern money platform across fiat, crypto, and investments - subject to regulatory approvals. The platform is being designed to break down traditional barriers to money across access, assets, and experience, enabling simpler, more adaptive ways for people to interact with financial services. We are currently developing our MVP and navigating licensing requirements, with a multidisciplinary team of 100+ people representing 20+ nationalities. With our headquarters in the UAE and offices in Portugal and Ukraine, we are united behind a shared ambition and a relentless focus on serving our customers. We have zero tolerance for rudeness.

About this role

As part of our team, you'll help us shape a platform that works for One — a business owner, an artist, a freelancer.

You'll be accountable for UMO's information security programme end to end: strategy, requirements, risk, incident readiness and results. You'll own the Information Security Management System (ISMS) and the Technology Risk Management Framework across our markets in the DIFC, UAE mainland and Africa.

You'll report directly to the CEO / Founder and have direct access to the Board. You'll work independently of the technology function, in close partnership with the CTO, COO and CCO/MLRO, and you'll chair the Information Security Steering Committee (ISSC).

We give you real executive autonomy with no corporate friction, so you can build a resilient, Zero Trust security architecture across our money platform, end to end.

You'll take ownership of:

Security Programme Ownership: Own the information security strategy, programme, and roadmap, reporting directly to the CEO. Lead security for the company, not only oversee it: set the direction, define the requirements other teams must meet, and answer for the results.

Authority & Escalation: Escalate directly to the Board on material risks, and hold the authority to block or delay releases, launches, or changes that carry unacceptable security risk.

Governance & Strategy: Serve as the executive owner of the Technology Risk Management Framework, Information Security Policy Suite, and ISMS. Ensure alignment with recognized standards (ISO 27001, NIST, SOC 2, PCI DSS) and with the regulatory requirements of each jurisdiction we operate in:

DIFC: DFSA cyber risk management and technology governance requirements; DIFC Data Protection Law.

UAE mainland: CBUAE technology risk and information security requirements, VARA Technology and Information Rulebook (where applicable), UAE Personal Data Protection Law (PDPL), and UAE Information Assurance standards.

Africa: Local data protection, cybersecurity, and central bank requirements in each market we enter, including data residency and localisation rules.

Executive Reporting: Provide structured reports to the Board, ISSC, and Executive Committee (ExCo) on risk posture, control effectiveness, incident status, and residual risks.

Regulatory Compliance: Oversee regulatory cybersecurity reporting to the DFSA, CBUAE, VARA, and African regulators within each regulator's required timelines, including material incident notifications, detailed assessment reports, and post-incident analysis.

Audits & Attestations: Deliver the following outcomes on an agreed plan:

ISO 27001: Obtain the certificate and keep it through surveillance and recertification audits.

SOC 2: Pass the audit and obtain an independent auditor's report.

PCI DSS: Pass the assessment and confirm compliance with the standard.

Prepare for repeat and new audits, act as the primary counterpart for auditors and regulatory inspections on security matters, and own the remediation of findings.

Asset Management: Oversee the asset classification process (software, infrastructure, data, people) based on Confidentiality, Integrity, and Availability (CIA) scores and maintain the Asset Log.

Data Protection: Own data classification, encryption standards, and Data Loss Prevention (DLP) controls. Work with the DPO to ensure compliance with the DIFC Data Protection Law, UAE PDPL, and African data protection laws, including cross-border data transfer and data residency requirements.

Identity & Access Management: Define and enforce IAM policy, Zero Trust principles, and Privileged Access Management (PAM). Oversee regular access reviews across all environments.

Threat & Vulnerability Management: Lead the identification of threats across internal configurations, external attacks, and cloud environments. Use OWASP Top 10, penetration testing, and threat intelligence.

Secure Development (in collaboration with Infrastructure & DevSecOps): Set security requirements and standards for the software development lifecycle. Work with the Head of Infrastructure & DevSecOps, who owns their implementation (SAST/DAST, dependency scanning, secret management in CI/CD), and oversee their effectiveness.

Crypto Asset Security: Govern the security of crypto custody, wallet infrastructure, and private key management, including HSM/MPC-based solutions.

Third-Party & Vendor Risk: Run security due diligence and ongoing monitoring of vendors, cloud providers, and banking/BaaS partners across all markets. Ensure contracts include appropriate security and incident-notification clauses.

Risk Mitigation: Oversee the Technology Risk Register. Approve risk treatment strategies (Mitigation, Transfer, Acceptance, Avoidance) and enforce remediation deadlines.

Security Controls: Implement and monitor preventive and detective controls, including MFA, network segmentation, RBAC, SIEM, and IDS/IPS.

Incident Leadership: Take command of major security incidents affecting payment systems, APIs, and cloud infrastructure. Set priorities, make decisions within your delegated authority, bring in the right people, and keep the CEO informed throughout.

Incident Readiness: Own the incident response procedures and playbooks, run regular exercises and simulations, and make sure a designated deputy can lead the response when you are unavailable.

Business Continuity: Coordinate Business Continuity (BCP) and Disaster Recovery (DRP) plans.

Security Visibility: Govern the penetration testing lifecycle and oversee enterprise-wide visibility through continuous scanning and log analysis.

Financial Crime Collaboration: Work with the CCO/MLRO on fraud prevention, AML transaction monitoring, and sanctions screening from a security and data-integrity perspective.

Security Awareness: Run a company-wide security awareness program, including regular training and phishing simulations.

Budget & Metrics: Own the information security budget. Define and report security KPIs such as MTTD/MTTR, vulnerability remediation rates, and risk treatment status.

Culture & Leadership: Build and lead the Information Security function. Drive a "security-first" culture across engineering, product, and operations teams.

Stakeholder Management: Maintain strong relationships with regulators, auditors, and third-party providers. Co-approve high residual risks with the CEO.

About you:

Experience: 10+ years in Information Security, Cybersecurity, or Technology Risk roles.

Frameworks: Proven experience implementing an ISMS aligned with ISO 27001, NIST, or comparable frameworks.

Audit Track Record: You have led at least one completed audit to a successful outcome: an ISO 27001 certification, a SOC 2 audit report, or a PCI DSS compliance assessment.

Technical Depth: Deep knowledge of cloud security (AWS, GCP, or Azure), hybrid environments, and API-based ecosystems.

Industry Background: Experience in regulated environments (FinTech, virtual assets, payments, or money platforms).

Regional Regulatory Knowledge: Working knowledge of UAE financial and data protection regulation (DFSA, CBUAE, VARA, PDPL).

Leadership: Proven track record of reporting to Boards and regulators; experience leading major incidents and crisis situations.

Communication: Exceptional ability to communicate complex security concepts to both technical teams and non-technical stakeholders.

Languages: Fluent English. Russian and Ukrainian are preferred.

Can get you a few bonus points:

Certifications: CISSP, CISM, CRISC, or ISO 27001 Lead Implementer/Auditor.

Broader Audit Experience: You have delivered more than one of ISO 27001, SOC 2, and PCI DSS, or taken a company through one of them from scratch.

UAE Regulator Experience: You have gone through a DFSA, CBUAE, or VARA licensing process, inspection, or cyber resilience assessment.

African Markets: Experience with financial services regulation and data localisation requirements in African markets.

Crypto Security: Hands-on experience securing crypto wallets, HSM/MPC-based key management, or high-volume payment gateways.

Automation Skills: Go or Python for security automation.

Startup Exposure: You have scaled a security function from MVP to production in a fast-moving startup.

The UMO Standard:

Mandate & Ownership: Full ownership of the product organization and roadmap, reporting directly to the founders.

Equity: A meaningful equity stake in a venture built from zero to one.

Location & Flexibility: Base yourself in Lisbon, Dubai, Kyiv, or Lviv, with openness to remote for the right fit.

Impact & Ownership: Your work directly shapes the product and company direction — not just executes it.