Head of Information Security

Head of Information SecurityTerraStakes | Dubai, United Arab Emirates | HybridCompany DescriptionTerraStakes is developing a platform that tokenizes income-generating UAE real estate into diversified investment portfolios. The company structures portfolios across built property, productive land, hospitality, and vacation homes, with each portfolio represented by its own token. Token investors gain exposure to every asset in a portfolio, weighted by value, with quarterly distributions paid in AED. All assets are rigorously verified before inclusion, including title checks, independent valuations, legal review, and ring-fenced SPVs for each property. TerraStakes is currently pre-licence and under development, engaging both investors and property owners through a waitlist model.About the roleThe Head of Information Security owns information security, technology risk and data protection across the company: the governance and control framework, key and signing governance, identity and access, application and cloud security, investor data protection, detection and response, fraud prevention and third-party assurance. The role produces the evidence regulators and auditors will rely on.The role reports to the Chief Executive Officer rather than the Chief Technology Officer by design: security assurance should not report into the function it assures, and a regulator will look for that separation.Key responsibilities1. Security governance

• Build the information security management system: policies, standards, control framework, risk register, exceptions and the governance forum that keeps it alive.
• Set the risk appetite with the founders and hold the line on it under delivery pressure.
• Own the security content of regulatory submissions and the evidence behind every assertion.
• Prepare for external certification where it earns its place commercially.2. Keys, signing and the custody boundary
• Govern key material: holders, signing thresholds, separation of duties, ceremonies, backup, recovery and destruction, agreed with the CTO and counsel before any production key exists.
• Enforce maker-checker on every privileged action, so no single person can move value or change a critical parameter alone.
• Assure the boundary with licensed custodians and wallet-infrastructure providers, including provider failure or suspension. The company holds no keys to investor assets.
• Review smart contract audit scope, challenge dismissed findings and track remediation with the Head of Blockchain and AI Engineering.3. Identity, access and people
• Identity and access management across cloud, code, data and admin interfaces, including privileged access and break-glass.
• A joiner, mover and leaver process that works in a fast-growing company, and vetting standards for roles touching keys, client money or investor data.
• Security awareness built on the company's real threat model.4. Application, cloud and infrastructure security
• Secure development lifecycle: threat modeling, design and code review, static and dynamic analysis, supply chain control and secrets management.
• Cloud posture, network segmentation, hardening, infrastructure as code review and environment separation.
• Build and release integrity, including who can deploy to production and how that is evidenced.5. Data protection and investor data
• Own data protection under the applicable UAE federal and free zone regimes: data mapping, classification, retention and deletion, lawful basis, cross-border transfers and subject rights.
• Minimization by design: investor records hold only what is required, visible to as few systems and people as possible.
• Vendor data processing terms, and what each vendor can actually see.6. Detection, response and continuity
• Logging and monitoring across application, ledger, cloud and payment paths, with alerting a small team can live with.
• An incident response plan that names people, covers regulatory notification timelines and has been rehearsed.
• Business continuity and disaster recovery tested against realistic scenarios, including loss of a critical provider or key holder, with post-incident reviews that change the system.7. Fraud, social engineering and brand abuse
• Callback and out-of-band confirmation on anything that moves money or changes a payment destination.
• Brand, domain and app monitoring, phishing takedown and response to fraudulent pages or tokens using the company's name.
• Investor-facing security guidance.8. Third-party assurance, audit and reporting
• A third-party risk register covering custody, key management, screening, cloud, banking and development providers, with due diligence, contractual security terms, real reassessment and exit plans for critical providers.
• Commission penetration testing and red team work and own the remediation backlog.
• Host external audits and regulator inspections, produce evidence on request, and report security posture to the founders in terms a board can act on.9. Team and communication
• Build and lead the security function from one person upward, and write clearly for regulators, auditors and the board.Standards that bind the role
• Nothing touching the company's regulatory position is finalized without the Chief Legal and Compliance Officer.
• Every security assertion to a regulator, auditor or partner is backed by evidence that exists on the day it is made.
• No external statements on security posture, incidents, technology, vendors or partners before approval for disclosure.
• No yield figures, return projections or promotional language in any client, investor or partner material.RequirementsEssential
• 8+ years in information security, including time in a regulated financial institution, exchange, custodian, bank or licensed digital asset business.
• Built a security program from a low base, and can show what you built.
• Hands-on depth in at least two of cloud security, application security, cryptographic key management, or detection and response, with breadth across the rest.
• Practical key management and signing controls, including HSMs and multi-party or threshold schemes.
• Handled a real incident, including one that went badly.
• Regulator- or auditor-facing work, and the ability to write for that reader.
• Working knowledge of data protection and how it translates into system design.Preferred
• Digital asset or tokenization experience, particularly custody, wallet infrastructure or smart contract assurance.
• Familiarity with UAE regulatory regimes, or an equivalent regime elsewhere.
• Standing up an ISMS to a recognized standard.
• Arabic alongside English. Certifications help; hands-on evidence carries more weight.Proof we will ask for
• A security program, policy set or control framework you built, a key ceremony or signing governance you designed, an incident post-mortem you led, and a regulator or audit submission you prepared (redacted where needed).What success looks like in the first year
• Within 90 days: a threat model, a control framework mapped to regulatory requirements with an honest gap assessment, a data map of investor information, and an incident response plan with a rehearsed first hour.
• Security content of regulatory submissions accepted; key and signing governance tested before the first production key.
• Penetration testing and smart contract audit closed with no critical or high findings open at launch.
• Investor data mapped, minimized and protected; incidents detected by us, not reported to us; no loss of keys, client money or investor data; third-party exit plans real.Succession and continuity
• This is a senior executive role and the regulator will expect a succession plan: a named deputy within the first year, a documented delegation of authority, and no single person, including the role holder, as a point of failure for keys, signing or incident command. Reviewed and tested at least annually.One question we will ask at interviewThe night before a large payment, finance receives a convincing email changing the destination bank account. What should already exist so it fails?Engagement and compensation
• Senior roles start part-time and convert to full-time when the seed round closes; base compensation for the initial period is deferred on terms agreed in writing before start.
• Compensation is benchmarked to financial services market data for the exact title, as basic salary plus allowances.
• Equity participation in the company's share plan.How to applySend your CV to founders@terrastakes.com with the role title in the subject line, and a short note on the security program you are proudest of building and an incident that taught you something. Shortlisted candidates are invited to an initial interview; detailed information follows a mutual non-disclosure agreement at second stage. TerraStakes is an equal opportunity employer.