IT Security Engineer

About the Role

At Mal, we are pioneering the world's first Sharia-compliant, AI-powered digital bank, delivering ethical financial services for Muslims worldwide. As we scale, we recognize the foundational importance of securing every endpoint, identity, and mailbox—before our team even accesses production systems. Our commitment to automation and security-by-design means every layer, from device posture to identity management, must be robust, integrated, and scalable.As an IT Security Engineer, you will own and evolve Mal’s endpoint-to-identity security layer. You’ll architect, implement, and automate solutions across MDM, EDR, identity and access, email security, DLP, and credential management. Your mission: ensure every device and user at Mal is protected with minimal manual overhead, championing a "security as code" philosophy that aligns with our AI-first, modern banking vision.

Key Responsibilities

• Design, deploy, and operate Mobile Device Management (MDM) across the fleet (Jamf for macOS/iOS, Intune for Windows/Android), including enrollment, compliance policies, and configuration baselines
• Own Endpoint Detection and Response (EDR) tooling (e.g. Checkpoint Harmony or equivalent) — deployment, detection tuning, and response workflows
• Own workforce Identity Provider (IdP) architecture (Okta), including SSO, conditional access, MFA/passwordless enrollment, and lifecycle (JML) automation, integrated with Google Workspace (GWS) as the core productivity identity
• Design and operate Secure Email Gateway (SEG) controls — phishing/malware filtering, DMARC/DKIM/SPF posture, and email-borne threat response
• Design and operate Data Loss Prevention (DLP) controls across email, endpoints, and SaaS, calibrated to Mal’s data classification requirements
• Own the enterprise password manager (1Password or equivalent) — vault architecture, sharing policies, and credential lifecycle for both individual and shared/service credentials
• Build workforce IAM automation across the full stack above — provisioning, deprovisioning, access reviews, and entitlement management — treating identity as the connective tissue between every tool
• Automate IT security operations by default: script and integrate rather than click through consoles, and evaluate where AI agents can take on routine detection triage, ticket handling, or access-review workflows
• Partner with GRC on control evidence, audit readiness, and mapping IT security controls to regulatory requirements (CBUAE, ISO 27001, SOC 2)
• Partner with DevSecOps/SRE on the workforce-to-infrastructure identity boundary, keeping IAM patterns consistent across both domainsMust-Have Qualifications:
• 4+ years in an IT Security, Corporate Security Engineering, or IT Infrastructure role with direct hands-on ownership of security tooling (not policy-only)
• Direct hands-on experience with an MDM platform — Jamf and/or Intune — including enrollment and compliance policy design
• Direct hands-on experience with an EDR platform (Checkpoint or comparable — e.g. CrowdStrike, SentinelOne, Microsoft Defender)
• Direct hands-on experience administering Okta or a comparable IdP, including SSO, conditional access, and lifecycle automation
• Experience administering Google Workspace (GWS) at the security/admin level, or a comparable productivity suite (Microsoft 365)
• Experience implementing DLP controls across email, endpoint, or SaaS
• Experience administering an enterprise password manager (1Password or comparable — e.g. Bitwarden)
• Strong scripting/automation ability (Python, or equivalent) with real experience automating IT security workflows via API rather than manual console work
• Demonstrated ability to work across GRC, DevOps, and IAM stakeholders without needing every requirement handed to you pre-translated
• Comfortable operating in a regulated environment (financial services, fintech, or similarly compliance-heavy sector)Nice to Have:
• Experience designing or operating a Secure Email Gateway (SEG) beyond native Google/Microsoft filtering
• Experience with IT security automation via low-code/workflow tools (e.g. Tines, Torq) or custom integration frameworks
• Direct experience evaluating or deploying AI agents/LLM-based automation for IT operations or security triage
• Experience in a bank, fintech, or ADGM/CBUAE-regulated environment
• Familiarity with SOC 2, ISO 27001:2022, or CBUAE technology-risk control requirements as they apply to endpoint and identity
• Experience building Zero Trust device-trust conditional access (e.g. Okta + device posture signals)
• Relevant certifications: Jamf Certified Expert, Microsoft Certified: Endpoint Administrator, Okta Certified Professional
• Experience with vendor/SaaS security triage for new tool onboarding (shadow IT reduction)First 60 Days:
• Complete an assessment of current MDM enrollment coverage and compliance policy gaps across the fleet
• Stand up or harden EDR coverage with a first pass of tuned detections and a documented response workflow
• Audit Okta conditional access and lifecycle automation for at least one critical user population, closing the highest-priority gaps
• Ship the first automated (non-console) workflow for a recurring IT security task — e.g. access review, JML step, or DLP alert triage
• Deliver a short options paper on where AI-agent automation could take over a specific routine IT security task
• Establish a working cadence with GRC for control evidence and with DevOps/SRE on the IAM boundary