Senior Security Engineer at VFD Group – Lagos

VFD Group is recruiting a full-time Senior Security Engineer in Lagos. The role is a technical lead position responsible for evaluating and validating cybersecurity controls, data-privacy frameworks and technical architectures across the Group’s subsidiaries.

It leads technical risk assessments, including penetration testing, vulnerability scanning, Data Protection Impact Assessments (DPIAs) and threat modelling, to identify security gaps in cloud, on-premise and application environments.

Key Responsibilities

Security Assurance and Architecture Assessment

• Evaluate defence-in-depth frameworks across the Group’s financial-services and subsidiary environment to assess control effectiveness and identify coverage gaps.
• Conduct risk-based architecture reviews, threat-modelling assessments and security-design evaluations for software platforms, infrastructure and third-party integrations.
• Assess technical architectures against regulatory requirements, ISO 27001, PCI-DSS, NIST CSF and internal security policies.

Vulnerability Assessment and Penetration Testing

• Plan and execute vulnerability assessments across cloud, hybrid and on-premise infrastructure, API endpoints and web/mobile applications.
• Conduct ethical hacking and internal and external penetration tests to identify exploit paths, logic flaws and privilege-escalation vulnerabilities.
• Perform SAST/DAST reviews and source-code security audits before production deployment.

Data Protection and Privacy Assurance

• Conduct DPIAs and privacy-compliance reviews for new systems, data workflows and third-party integrations handling sensitive customer data.
• Validate data classification, encryption at rest and in transit, data-loss prevention and access controls in line with the NDPA, GDPR and enterprise policies.
• Assess data-retention, anonymisation and secure-destruction practices across Group entities.

Cloud, Infrastructure and Incident Assurance

• Assess AWS, Azure and on-premise environments for compliance with identity and access management, encryption and network-segmentation standards.
• Evaluate DevSecOps automation, CI/CD security gates and infrastructure-as-code deployments against security baselines.
• Conduct post-incident reviews, forensic audits and root-cause analyses; examine threat vectors, forensic evidence and telemetry logs; and verify that corrective and preventive actions are implemented.

Standards, Tooling and Control Effectiveness

• Establish baseline security-compliance checklists for operating systems, containerised environments and network infrastructure.
• Assess secure-coding practices and application-security standards across engineering teams.
• Carry out periodic compliance audits and continuous monitoring to identify and address configuration drift.
• Assess the coverage, configuration and operational readiness of SIEM, EDR, WAF, DLP and vulnerability-management platforms.
• Validate threat-detection rules, alert logic and SOC playbooks, and evaluate security technologies and third-party solutions against Group requirements.

Risk Remediation and Technical Advisory

• Translate enterprise risk findings, vulnerability assessments, penetration-test results and regulatory audit findings into prioritised technical remediation plans.
• Validate the implementation and effectiveness of technical mitigations introduced by engineering teams.
• Report technical KRIs, KPIs and control-maturity measures to executive leadership and risk committees.
• Provide technical guidance and mentorship to analysts, audit colleagues and engineering leads, and support security-awareness workshops and policy reviews.

Education, Certifications and Experience

• Bachelor’s or Master’s degree in Computer Science, Information Security or a related field.
• Certifications listed for the role include CISSP, Certified Ethical Hacker (CEH), AWS Certified Solution Architect, AWS Certified Security Specialty, Microsoft Certified Azure Security Engineer and OCI Certified Security Professional.
• Six to eight years’ proven experience in computing and information security. Experience in fintech, banking or mobile money is preferred.
• Strong understanding of emerging technologies, cloud computing and mobile security.
• Familiarity with risk-management methodologies and techniques.
• Leadership and management skills, including the ability to motivate cross-functional teams.
• Ability to work in a fast-paced environment while balancing multiple priorities and deadlines.