{"id":1758839,"url":"https://alion.io/job/credit-direct-senior-security-engineer","title":"Senior Security Engineer","company":{"id":2484947,"name":"Credit Direct","domain":"creditdirect.ng","url":"https://alion.io/company/creditdirect","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"SeamlessHiring","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Lagos, Nigeria"],"countries":["NG"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":25000,"max_usd":58000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":1891},"experience_years_min":6,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Amazon Aurora","optional":false},{"name":"Amazon CloudWatch","optional":false},{"name":"Amazon DocumentDB","optional":false},{"name":"Amazon EKS","optional":false},{"name":"Amazon S3","optional":false},{"name":"AWS","optional":false},{"name":"AWS WAF","optional":false},{"name":"CI/CD","optional":false},{"name":"Datadog","optional":false},{"name":"Datadog Cloud Security","optional":false},{"name":"DynamoDB","optional":false},{"name":"External Secrets","optional":false},{"name":"GDPR","optional":false},{"name":"GitHub Actions","optional":false},{"name":"GitOps","optional":false},{"name":"Helm","optional":false},{"name":"IAM","optional":false},{"name":"ISO 27001","optional":false},{"name":"Kubernetes","optional":false},{"name":"Kyverno","optional":false},{"name":"Least Privilege","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"NIST CSF","optional":false},{"name":"OPA Gatekeeper","optional":false},{"name":"PCI DSS","optional":false},{"name":"Python","optional":false},{"name":"Rest API","optional":false},{"name":"SIEM","optional":false},{"name":"SQL","optional":false},{"name":"STRIDE","optional":false},{"name":"Terraform","optional":false},{"name":"Open Policy Agent","optional":true}],"status":"live","first_seen_at":"2026-09-17T00:00:00Z","employer_posted_date":"2026-09-17","last_verified_at":"2026-10-12T12:00:40Z","board_verified":true,"closed_at":null,"days_open":25,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":25},"description":"To design, implement and continuously improve the technical security controls that protect the organization's AWS cloud estate, Kubernetes (EKS) platform, software delivery pipelines and data stores; and to provide expert detection, response and assurance capability that keeps the organization's digital services resilient, auditable and compliant with CBN, PCI DSS, ISO 27001 and NDPR requirements.\nResponsibilities\nRESPONSIBILITIES:\nCloud and Security Engineering:\nDesign, implement and maintain preventive and detective security controls across all AWS accounts, including AWS Organizations service control policies, AWS Config rules and conformance packs, AWS WAF and AWS Shield.\nEnforce least privilege through IAM roles, permission boundaries, IAM Identity Center and IAM Access Analyzer; drive the elimination of long-lived access keys in favour of federated and role-based access.\nOwn AWS Secrets Manager end to end - secret lifecycle, automatic rotation, resource and cross-account policies - and lead the removal of hard-coded credentials from application code, manifests and pipelines.\nConfigure and maintain organization-wide AWS CloudTrail (including data and management events), CloudWatch log groups, metric filters, alarms and retention aligned to regulatory record-keeping requirements.\nImplement AWS Config baselines with automated drift detection and remediation against CIS AWS Foundations and PCI DSS benchmarks.\nManage AWS WAF rule sets, rate limiting, bot control and geo restrictions for internet-facing applications behind CloudFront and ALB, and tune rules to minimise false positives without weakening protection.\nOperate Amazon GuardDuty, AWS Security Hub, Amazon Inspector and Amazon Detective as a single triage workflow - from finding, to enrichment and root-cause investigation, to verified closure.\nDefine and review secure landing zone and VPC network patterns (segmentation, private subnets, VPC endpoints, security groups, managed prefix lists) and assess new architectures against them.\nKubernetes & Container Security (Amazon EKS):\nHarden EKS clusters: private API endpoints, control plane audit logging to CloudWatch, node group hardening, and timely patching of cluster versions and node AMIs.\nDesign, implement and periodically review Kubernetes RBAC, namespace isolation, service accounts and IAM Roles for Service Accounts (IRSA) / EKS Pod Identity.\nEnforce Pod Security Standards, admission control policy (OPA Gatekeeper or Kyverno) and Kubernetes network policies to restrict east-west traffic.\nSecure the container supply chain - approved base images, ECR and Amazon Inspector image scanning, image signing and admission-time signature verification.\nDeploy and tune runtime threat detection for containers (GuardDuty EKS Runtime Monitoring, Datadog Cloud Security Management) and investigate detections through to resolution.\nSecure secret delivery into workloads using the External Secrets Operator or Secrets Store CSI driver backed by AWS Secrets Manager, removing plaintext secrets from manifests and Helm values.\nSecurity Monitoring, Detection & Incident Response (Datadog):\nBuild and maintain detection coverage in Datadog Cloud SIEM - log pipelines, detection rules, signal correlation, suppression tuning and security dashboards.\nOperate Datadog Cloud Security Management (misconfiguration, identity and workload risk) and Application Security Management (runtime protection and vulnerability detection) alongside native AWS security services.\nConfigure Datadog Sensitive Data Scanner to detect and redact PII and cardholder data in logs and telemetry.\nEnsure complete, tamper-evident log coverage across AWS, EKS, applications and databases, with defined retention, archiving and log integrity controls.\nLead technical security incident response - triage, containment, eradication, recovery and post-incident review - and maintain runbooks, escalation paths and tabletop exercises.\nDefine, track and report security metrics and posture trends to management and risk committees.\nData & Database Security:\nEnforce encryption at rest and in transit across RDS, Aurora, DocumentDB, DynamoDB, S3, EBS and EFS using AWS KMS, with defined key policies, rotation and separation of duties.\nImplement IAM database authentication and Secrets Manager-driven credential rotation; remove shared, static and over-privileged database accounts in favour of least-privilege roles.\nEnable, centralise and monitor database audit logging (RDS and Aurora audit logs, DocumentDB auditing, SQL Server audit, CloudTrail data events) within the central log platform.\nApply data classification, masking or tokenisation and access controls for sensitive and regulated data, and support data loss prevention requirements.\nEliminate public database exposure - private subnets, restrictive security groups, no public accessibility - and validate backup and snapshot encryption, snapshot sharing controls and restore testing.\nReview database migrations, schema changes and access grants for security impact before approval.\nGovernance, Risk & Compliance:\nTranslate CBN cybersecurity framework, PCI DSS, ISO 27001, NIST CSF and NDPR requirements into enforceable technical controls and repeatable evidence.\nMaintain security standards, secure configuration baselines and control documentation, and support internal and external audits with automated evidence collection.\nConduct security assessments, vulnerability management cycles and configuration reviews; coordinate penetration testing and track remediation to closure.\nPerform security reviews of third-party vendors, SaaS integrations and exposed APIs\nContribute to risk register maintenance, security exception management and management reporting.\nCollaboration, Enablement & Technical Leadership:\nAct as senior security advisor to infrastructure, platform, DevOps and application teams during architecture, design and change reviews.\nMentor junior security and platform engineers, and raise the standard of security code and configuration review across engineering.\nAutomate recurring security operations using Python, Bash, Terraform and AWS-native tooling to reduce manual effort and human error.\nDeliver targeted, role-relevant security training for engineering teams covering secure coding, secrets handling and incident escalation.\nRequirements\nBachelor's degree in Computer Science, Information Security, Engineering or a related discipline.\nProfessional certification is strongly preferred, for example: AWS Certified Security - Specialty, Certified Kubernetes Security Specialist (CKS), CISSP, CISM, CCSP, OSCP, or GIAC certifications (GCSA, GCIH, GWAPT, GCLD).\nMinimum of 6-8 years' experience in cybersecurity or security engineering, including at least 4 years securing production AWS workloads and at least 2 years securing Kubernetes (preferably Amazon EKS) and CI/CD pipelines.\nDemonstrable, hands-on experience implementing cloud, container, pipeline and database security controls in a regulated environment; financial services experience is an advantage.\nProven track record of leading security incident investigations and remediation in production environments\nCOMPETENCIES REQUIREMENTS:\nTechnical:\nDeep, hands-on AWS security expertise: IAM, KMS, Secrets Manager, CloudTrail, CloudWatch, AWS Config, WAF and Shield, GuardDuty, Security Hub, Inspector, Detective and VPC network security.\nStrong Kubernetes and Amazon EKS security skills: RBAC, IRSA, Pod Security Standards, admission controllers (OPA Gatekeeper or Kyverno), network policies, image scanning, image signing and runtime security.\nPractical experience implementing SCA, SAST, DAST, secret scanning and IaC scanning within GitHub Actions, and enforcing branch protection rules, rulesets and OIDC-based pipeline authentication.\nWorking knowledge of Datadog security capabilities: Cloud SIEM, Cloud Security Management, Application Security Management, Sensitive Data Scanner, log pipelines and dashboards.\nDatabase security across RDS, Aurora, DocumentDB, SQL Server and NoSQL stores: encryption and key management, IAM authentication, audit logging, masking and least-privilege access.\nInfrastructure as code and automation: Terraform, Helm and GitOps workflows, with proficient scripting in Python and Bash.\nSolid grounding in security frameworks and regulation: CBN cybersecurity guidelines, PCI DSS, ISO 27001, NIST CSF, NDPR and GDPR; threat modelling (STRIDE) and MITRE ATT&CK.\nVulnerability management, incident response and digital forensics fundamentals.\nBehavioural:\nStrong analytical and problem-solving skills, with sound risk judgement and the ability to prioritise what matters most.\nExcellent written and verbal communication; able to explain technical risk to non-technical stakeholders and influence engineering teams without direct authority.\nOwnership mindset - detail-oriented, proactive and persistent in identifying and closing control gaps.\nPragmatic and collaborative; balances security rigour against delivery velocity.\nCalm, structured and decisive under incident pressure.\nCoaching and knowledge-sharing orientation, with a commitment to raising security capability across the organization.\nBenefits\nAt Credit Direct Limited, we value our employees and strive to provide a comprehensive benefits package that recognizes their contributions and supports their well-being. As part of our commitment to a positive work environment, we offer the following benefits:\nCompetitive Salary: We offer a competitive salary structure that is commensurate with industry standards and recognizes the skills and experience of our employees.\nQuarterly Performance Pay: We recognize and reward exceptional performance. Our quarterly performance pay program allows employees to earn additional compensation based on their individual and team achievements.\nTransport Subsidy: We understand the importance of accessible transportation for our employees. To assist with commuting expenses, we provide a transport subsidy to help alleviate the financial burden associated with travel to and from work.\nStaff Bus: We offer a convenient and reliable staff bus service for eligible employees, ensuring a comfortable and stress-free commute to the workplace.\nHybrid Work: We believe in providing flexibility and work-life balance. Our hybrid work policy allows eligible employees to work remotely for a certain number of days per week, promoting a healthy work-life integration.\n13th Month Salary: As an additional financial benefit, we provide a 13th-month salary to our employees. This extra payment, usually received at the end of the year, serves as a bonus and acknowledges their dedication and commitment throughout the year.\nLeave Allowance: We recognize the importance of taking time off for rest and relaxation. In addition to annual leave entitlement, we provide a leave allowance to eligible employees, offering financial support during their vacation time.\nProfit Sharing: We believe in sharing our success with our employees. Through our profit-sharing program, eligible employees have the opportunity to receive a share of the company's profits, providing an additional incentive for their dedication and hard work.\nThese benefits are designed to support our employees' financial well-being, work-life balance, and professional growth. We continuously review and enhance our benefits package to ensure that it remains competitive and aligned with the needs and preferences of our valued employees.","description_format":"text","description_chars":11476,"description_truncated":false,"requirements":{"experience_years_min":6,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Annual leave","Hybrid work"],"hiring_locations":[{"name":"Nigeria","iso":"NG","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security"],"lifecycle":[{"event":"open","at":"2026-10-03T12:00:13Z"}],"visa":[],"liveness":{"score":32,"band":"fade","label":"Fading","p_open":1,"p_active":0.717,"p_room":0.45,"age_days":25,"expected_fill_days":14,"reasons":["conf:1","win:tail"],"computed_at":"2026-10-12T06:55:09Z"},"pay":null,"html_url":"https://alion.io/job/credit-direct-senior-security-engineer","json_url":"https://alion.io/job/credit-direct-senior-security-engineer.json","meta":{"generated_at":"2026-10-12T14:06:44Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":22184,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-13T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2484947},"rest":"https://alion.io/mcp/rest/get_company?id=2484947"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fcredit-direct-senior-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fcredit-direct-senior-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fcredit-direct-senior-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/credit-direct-senior-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fcredit-direct-senior-security-engineer"}]}