Head of Information Security at PiggyTech Global Limited (PiggyVest) – Lagos

PiggyTech Global Limited (PiggyVest) is recruiting a Head of Information Security for its Victoria Island, Lagos office. The role leads the organisation’s information-security strategy and protects its systems, platforms and data while supporting business growth and operational resilience. It oversees security governance, cybersecurity risk, security operations, incident response, compliance, team delivery and budget management.

Key responsibilities

Security strategy and programme leadership

• Develop and maintain an information-security roadmap aligned with business objectives, regulatory requirements and emerging threats.
• Develop the cybersecurity strategy and programme for governance approval and lead implementation of the Board-approved strategy.
• Lead initiatives including ISO 27001, security contributions to ISO 22301, vulnerability assessments and cybersecurity improvement programmes.
• Define project scope, ownership, timelines and resources, and manage the information-security budget and investment priorities.

Team leadership and security operations

• Lead the information-security team, set objectives, allocate responsibilities and review work quality and timeliness.
• Provide technical guidance, coaching and mentorship, manage performance and support recruitment, onboarding and professional development.
• Oversee monitoring across applications, cloud infrastructure, networks, endpoints and internal systems.
• Lead significant incident responses, including investigation, containment, recovery, stakeholder communication, evidence preservation and post-incident reviews.
• Maintain incident-response plans and playbooks and conduct readiness exercises.

Cybersecurity risk, architecture and vulnerability management

• Lead cybersecurity risk assessments across systems, business processes, new products and major technology changes.
• Maintain the cybersecurity risk register, assign risk owners and treatment plans, evaluate controls and escalate material risks and overdue remediation.
• Work with Technology and Product teams to embed security in system design, development, deployment and change management.
• Review application, API, cloud and integration security, and oversee identity and access management, privileged access, secure configuration, encryption, secrets management and data protection.
• Lead vulnerability assessments, penetration testing and remediation tracking, prioritising issues by severity, exposure and business impact.
• Coordinate security audits and assessments, verify remediation and maintain supporting evidence.

Governance, compliance and resilience

• Maintain information-security policies, standards, procedures and supporting documentation.
• Lead security activities supporting applicable CBN cybersecurity frameworks and directives, the Nigeria Data Protection Act, ISO 27001, ISO 22301 and PCI DSS where applicable.
• Work with Risk, Compliance, Legal and data-protection stakeholders on regulatory obligations, audits, certification activities and required incident notifications.
• Track regulatory findings and commitments, ensuring corrective actions are completed and documented.
• Oversee vendor and third-party security assessments, access and data-handling requirements, and follow-up of material third-party risks.
• Support business-continuity and disaster-recovery planning, including security requirements for recovery procedures and testing.

Advisory, awareness and reporting

• Act as a primary source of information-security advice across the organisation.
• Lead security-awareness and role-specific training, promoting timely reporting and clear accountability.
• Define and report metrics for incident response, vulnerability remediation, control effectiveness, audit findings and programme delivery.
• Provide management and Board-level updates on security posture, material risks, incidents, remediation, resources and recommended actions.
• Monitor emerging threats and assess programme maturity, adapting priorities and tracking continuous improvement.

Requirements

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, Information Systems or a related discipline.
• At least 10 years of relevant experience across information security, cybersecurity, information technology, IT risk management, information-security risk management or IT audit, with substantial responsibility for governance and security controls.
• At least three years in a senior information-security leadership role, including team leadership, programme and budget management, and reporting material risks to executive management or Board committees.
• Current CISSP, CISM or CCISO certification is mandatory. ISO 27001 Lead Implementer or Lead Auditor certification is an advantage.
• Experience in financial services, fintech, payments or another regulated environment, with an understanding of digital financial-services security risks.
• Experience across security operations, incident response, vulnerability management, cloud security, application and API security, identity and access management, and cybersecurity risk management.
• Experience developing security strategies, policies, risk-assessment processes and incident-response arrangements, and maintaining an information-security management system.
• Working knowledge of CBN cybersecurity requirements, the Nigeria Data Protection Act, ISO 27001, ISO 22301 and PCI DSS where applicable.
• Experience engaging regulators, auditors, executive management and Board committees.
• Strong technical judgement, risk-based prioritisation, knowledge of SIEM, endpoint security, vulnerability-assessment and cloud-security tools, and the ability to lead teams, manage budgets and communicate technical risks clearly.