Senior Security Engineer Lagos

VFD Group is an alternative financial service holding company that creates value by working within Nigeria's informal financial sector to create innovative products and solutions that are accessible to the everyday Nigerian.

Starting as an idea, VFD Group has grown into a cross-border investment firm with a presence in Sub-Saharan Africa, the UK, and the US. We have expanded across sectors through collaboration and responsible leadership, building a diverse portfolio of companies focused on real-world impact and positive change. Each investment empowers communities and strengthens our presence in global markets, fuelling growth in Africa and beyond. We are  recruiting to fill the position below:

 Job Title: Senior Security Engineer

Location: Lagos

Employment Type: Full-time Job Summary

The Senior Security Engineer is a high-impact technical lead responsible for evaluating,testing,and validating the effectiveness of the Group’s cybersecurity controls,data privacy frameworks,and technical architectures across all subsidiary operations. This role leads technical risk assessments—including penetration testing,vulnerability scanning,Data Protection Impact Assessments (DPIAs),and threat modelling—to proactively identify security gaps in cloud,on-premise,and application environments.

Responsibities

Evaluate defense-in-depth frameworks across VFD Group's financial services and subsidiary ecosystem to validate control effectiveness and identify coverage gaps. Perform risk-based architecture reviews,threat modeling assessments,and security design evaluations for new software platforms,infrastructure,and third-party integrations. Audit and assure technical architectures against regulatory requirements,industry benchmarks (e.g.,ISO 27001,PCI-DSS,NIST CSF),and internal security policies.

Plan,scope,and execute comprehensive vulnerability assessments across cloud,hybrid,and on-premise infrastructure,API endpoints,and web/mobile applications. Conduct ethical hacking and internal/external penetration testing to proactively identify exploit paths,logic flaws,and privilege escalation vulnerabilities. Perform SAST/DAST reviews and source code security audits to validate application resilience before production deployment.

Conduct Data Protection Impact Assessments (DPIAs) and privacy compliance reviews for new systems,data workflows,and third-party integrations processing sensitive customer data. Validate the technical implementation of data classification,encryption-at-rest/in-transit,loss prevention (DLP),and access controls in accordance with NDPA,GDPR,and enterprise policies. Assess data retention,anonymization,and secure destruction practices across group entities to mitigate data exposure risks.

Assess multi-cloud (AWS,Azure) and on-premise environments to verify compliance with identity and access management (IAM),encryption,and network segmentation standards. Evaluate DevSecOps automation and CI/CD security gating,assuring that infrastructure-as-code deployments adhere to security baselines.

Conduct independent post-incident reviews,forensic audits,and root-cause analyses for severe security events to validate remediation efficacy. Analyze threat vectors,forensic artifacts,and telemetry logs during investigations to ensure threat containment and control validation. Review post-incident reports to verify that corrective and preventive action plans (CAPAs) are actionable and fully implemented.

Establish baseline security compliance checklists for operating systems,containerized environments,and network infrastructure. Assess adherence to secure coding practices and application security standards across engineering teams. Execute periodic compliance audits and continuous monitoring assessments to detect,track,and remediate configuration drift.

Assess the coverage,configuration quality,and operational readiness of core security stack tools (SIEM,EDR,WAF,DLP,and vulnerability management platforms). Validate the accuracy and coverage of automated threat detection rules,alert logic,and SOC playbooks to minimize false negatives and positives. Evaluate emerging security technologies and third-party vendor solutions to assure alignment with group security requirements.

Translate enterprise risk findings,vulnerability assessments,penetration testing results,and regulatory audit findings into prioritized technical remediation roadmaps. Validate the implementation and operational effectiveness of technical mitigations introduced by engineering teams. Track,report,and present technical Key Risk Indicators (KRIs),Key Performance Indicators (KPIs),and control maturity metrics to executive leadership and risk committees.

Deliver technical advisory and mentorship to junior analysts,audit peers,and engineering leads on security controls and risk mitigation strategies. Conduct independent reviews of security assessment findings,pentest reports,and privacy evaluations alongside development and operations teams. Drive continuous security assurance awareness across subsidiaries through targeted technical assessment workshops and policy reviews.

Specification & Qualifications

Bachelor's or Master's Degree in Computer Science, Information Security, or a related field. Certified Information Systems Security Professional (CISSP) Certified Ethical Hacker (CEH) AWS Certified Solution Architect AWS Certified Security Specialty Microsoft Certified Azure Security Engineer OCI Certified Security Professional

6 - 8 years of proven experience in computing and information security, including experience in Fintech, Banking or Mobile Money is preferred Strong understanding of emerging technologies, cloud computing, and mobile security. Familiarity with risk management methodologies and techniques. Excellent leadership and management skills, with the ability to inspire and motivate cross-functional teams. Demonstrated ability to work in a fast-paced and dynamic environment, balancing multiple priorities and deadline

Not Specified. How to Apply

Click Apply Now button to apply