Head of Cybersecurity

We are looking for a Head of Cybersecurity for our projects.

Our business is growing: new projects are launching, our infrastructure and user base are expanding, and so is the attack surface. We are opening the Head of Cybersecurity role to build the security function from scratch and become the company's key expert in protecting our products, infrastructure, and data.

Location: Remote

Reporting to: CEO

Responsibilities:

- Build the cybersecurity function from scratch as a hands-on Head: strategy, roadmap, priorities, budget, security vendors and tools

- Run an assessment of current products and infrastructure, identify key risks, and build a remediation plan

- Develop and implement security policies, standards and procedures: access management, incident response, vulnerability management, data protection

- Own infrastructure and cloud security together with DevOps: network security, hardening, secrets management, logging and monitoring

- Embed security into the development lifecycle: secure SDLC practices, SAST/DAST, dependency scanning, regular penetration tests

- Review and strengthen access and corporate security: RBAC, MFA, least-privilege access, onboarding and offboarding, device management (MDM), password management, Google Workspace and SaaS security

- Protect products and users from threats typical for iGaming: DDoS, account takeover, credential stuffing, API abuse

- Build incident detection and response: monitoring, alerting, playbooks, investigations and post-mortems

- Protect the brand and key people: detection and takedown of phishing, clone sites and fake accounts, protection of corporate social media accounts, OSINT monitoring of leaks and doxxing risks, OPSEC, and security awareness training

Requirements:

- 6+ years of experience in information security/cybersecurity, including 2+ years in a leadership role (Head of Security, Security Lead, CISO, Security Manager)

- Proven experience building a security function or core security processes from scratch in a product company

- Strong hands-on expertise in infrastructure and cloud security with at least one major cloud provider (AWS, GCP or Azure), Linux and containers

- Solid knowledge of application and API security: OWASP Top 10, SAST/DAST, coordination of penetration tests

- Practical experience with IAM, SIEM / log management, EDR, MDM and vulnerability management

- Hands-on experience leading response to real security incidents: DDoS, account takeover, data breaches and leaks, phishing and brand impersonation, including investigation and forensics

- Practical experience with OSINT and OPSEC: monitoring of leaks, fake accounts and doxxing risks, protection of corporate social media accounts and key people

- Ability to work directly with the CEO: explain risks in business terms, prioritize by real impact, and communicate clearly during incidents

- English at a level sufficient for working with documentation, vendors, and auditors

- Ukrainian and Russian at a level sufficient for day-to-day internal communication within the team

Nice to have:

- Experience in iGaming, gambling, esports, fintech, payments or crypto

- Experience with DDoS protection, WAF, and CDN solutions (e.g. Cloudflare)

- Experience securing crypto wallets and blockchain-related infrastructure

- Knowledge of GDPR requirements for personal data protection

- Experience hiring and managing a security team

- English B2

What we could offer:

- Remote full-time work

- Flexible schedule

- 24 working days of paid vacation

- 100% paid sick leave

- Competitive fixed salary + bonuses

- Long-term cooperation

- Career growth: building and leading your own security team