Director of Security

Head of Security

Reports to: CTO · Location: Nicosia, Cyprus · Leads: Corporate Security Engineer, Product Security Engineer; directs Corporate IT on security controls

The role

You lead TRG's security program and do its hardest technical work. Expect at least 60% of your week hands-on: investigating alerts, writing detections, reviewing architecture and testing our defences. You lead two engineers by example and review their changes. Compliance runs on automated evidence, so it takes no more than one day a week.

Outcomes you will own

• Lead every security investigation and incident hands-on, from first alert to post-mortem.
• Hunt for threats every week and write cross-domain detections in the SIEM; each engineer owns the detections in their domain.
• Review the architecture of every new platform, region and dedicated deployment before launch.
• Run internal penetration tests and red-team exercises between annual external tests.
• Review every security change your engineers make; they review yours.
• Lead TRG's compliance roadmap: achieve SOC 2 Type I, then Type II, and align our controls with NIST CSF and NIST SP 800-53. Build one control set that maps to all three, ready for future FedRAMP authorisation. Automate evidence collection to keep compliance under one day a week.
• Own the ISG Policy; approve the standards each engineer maintains under it.
• Lead customer security reviews and questionnaires as the technical authority.
• Run vendor risk reviews, including AI model providers.
• Run on-call, the incident response plan and the MDR provider for after-hours cover.
• Publish a monthly security posture report to the CTO and CEO.
• Agree employee monitoring scope with Legal and the DPO under GDPR before telemetry rollouts.
• Own the SIEM: centralise endpoint, identity, cloud and application logs, with retention that meets SOC 2 and NIST requirements.

First 90 days

1. Take over SOC 2 from the outgoing owner; publish a ranked risk register.
2. Assess identity, detection coverage and incident readiness yourself; fix the top five findings.
3. Ship the incident response playbooks and the first monthly posture report.

What you bring

• 8+ years in security, including 5+ years hands-on in incident response, detection engineering or offensive security.
• Led a team of 2 to 5 security engineers while staying hands-on.
• Investigates incidents across endpoint telemetry, cloud logs and network traffic.
• Writes detection rules and automation in Python or similar.
• Hands-on with cloud, container, endpoint and identity security.
• Delivered a SOC 2 or ISO 27001 certification as the accountable owner; working knowledge of NIST CSF and NIST SP 800-53.
• Writes clearly for executives, auditors and customers.

Nice to have

• OSCP, GCIH, GCFA or equivalent.
• Experience selling to government, defence or law enforcement customers.
• Familiarity with security for LLM-based products.
• Prepared a cloud product for FedRAMP authorisation.