VFD Group is an alternative financial service holding company that creates value by working within Nigeria's informal financial sector to create innovative products and solutions that are accessible to the everyday Nigerian.
We are recruiting to fill the position below:
Job Title: Information Security Manager
Location: Lagos Employment Type: Full-time
Job Summary
The Security Manager within the Group Information Security Office (GISO) bridges the gap between strategic governance and technical execution.
Reporting directly to the Group Chief Information Security Officer (CISO), this role will drive daily security operations, champion compliance initiatives, and ensure the resilience of VFD Group’s ecosystem against emerging threats.
Responsibiities Daily Security Operations & Tactical Execution:
Oversee daily security operations across all VFD Group entities, ensuring optimal uptime, coverage, and performance of core security infrastructure (SIEM, EDR, WAF, DLP, and identity controls).
Manage day-to-day workflow allocation, task prioritization, and deliverable quality for operational security analysts and engineers.
Enforce operational security baselines, configuration management standards, and change control approvals across cloud (AWS, OCI) and on-premises environments.
Incident Response & Crisis Management:
Lead the enterprise Incident Response (IR) function, serving as the operational incident commander for medium-to-critical security incidents and threat containment operations.
Drive post-incident investigations,root-cause analysis (RCA), and digital forensics, ensuring swift containment, eradication, and system recovery.
Maintain, test, and update Incident Response Plans (IRPs) and playbooks tailored to financial sector threat models (e.g., ransomware, payment fraud, credential stuffing, API abuse).
Prepare detailed post-incident review reports and execute Corrective and Preventive Action (CAPA) plans to ensure long-term risk elimination.
End-to-End Vulnerability Lifecycle Management:
Direct the enterprise vulnerability management program, overseeing automated scanning, manual
assessments, and penetration testing schedules across all subsidiary systems.
Prioritize vulnerability remediation based on asset criticality, business context, exploitability, and risk impact in coordination with engineering and IT operations teams.
Track remediation lifecycles strictly against established SLAs, establishing escalation paths for unpatched vulnerabilities or system configuration drift.
Validate technical patch efficacy and workarounds implemented by system owners prior to vulnerability ticket closure.
Regulatory Compliance & Policy Enforcement:
Maintain continuous compliance monitoring against applicable financial sector regulations, data privacy laws (e.g., NDPA, GDPR), and security frameworks (ISO 27001, ISO 22301, PCI-DSS, NIST CSF).
Coordinate internal security audits and support external regulatory examinations, facilitating evidence collection and audit response workflows.
Track and drive the technical remediation of findings stemming from internal/external audits, regulatory reviews, and third-party risk assessments.
Enforce compliance with enterprise information security policies, standards, and procedures across all group business units.
Security Awareness & Culture Transformation:
Develop, launch, and manage enterprise-wide security awareness training programs tailored to diverse employee roles across group entities.
Execute periodic simulated phishing campaigns, social engineering evaluations, and targeted role-based security training for high-risk personnel (e.g., developers, finance, executives).
Establish program metrics to evaluate culture shifts, track completion rates, and reduce human-risk vulnerabilities across the enterprise.
CISO Reporting & Strategic Metrics:
Compile, analyze, and present weekly and monthly operational security metrics, Key Performance Indicators (KPIs), and Key Risk Indicators (KRIs) to the Group CISO.
Provide actionable visibility into the enterprise threat landscape, open vulnerability exposures, incident trends, and control status across all subsidiaries.
Assist the Group CISO in preparing executive board decks, risk committee summaries, and regulatory status updates.
Escalate operational roadblocks, emerging high-severity risks, and resource bottlenecks to the Group CISO with proposed mitigation strategies.
Team Leadership & Cross-Functional Coordination:
Foster a high-performance,security-first team culture focused on technical rigor, operational efficiency, and clear communication.
Coordinate cross-functional initiatives alongside IT infrastructure, DevOps, application development, enterprise risk management, internal control, and internal audit leads.
Evaluate vendor security solutions, oversee third-party managed service providers, and manage operational tooling lifecycle management.
Education/Certifications
Bachelor's or Master's degree in computer science, information security, or a related field.
Professional certifications such as:
Certified Information Systems Security Professional (CISSP)
Certified Ethical Hacker (CEH)
Certified Information Security Manager (CISM)
ISO 27001 Lead Implementer
Experience
8 – 15 years of progressive experience in Cybersecurity, in SOC environments, Governance, Risk & Compliance (GRC), and Cybersecurity Engineering (Application Security, DevSecOps, and Cloud Security)
Master’s degree is an added advantage.
Relevant certifications (e.g., CISM, CISSP, CISA, or equivalent).
Proven experience managing security engineering, operations, or incident response teams, preferably within financial services or a diversified investment company.