Security Assurance Expert

The Security Assurance Expert will be responsible for strengthening MTN’s overall security posture through continuous penetration testing, API security assessments, cloud security posture management, DevSecOps implementation, vulnerability management, and compliance assessments. The role will work closely with security, development, and DevOps teams to embed security controls into CI/CD pipelines, identify and remediate vulnerabilities, validate fixes, and ensure alignment with ISO 27001, NIST, CIS Benchmarks, and PCI DSS.

• Perform continuous penetration testing across production and staging environments.
• Conduct security assessments of web applications, cloud-native services, APIs, and internal/public-facing applications.
• Perform dedicated API security testing covering authentication, authorization, injection, rate limiting, data exposure, and OWASP API Security Top 10.
• Identify, document, and report vulnerabilities with CVSS ratings, business impact, remediation recommendations, and PoC evidence.
• Conduct retesting and validation of remediated vulnerabilities.
• Design and implement DevSecOps security practices across development and CI/CD pipelines.
• Integrate security gates and controls into CI/CD workflows.
• Implement and support SAST, DAST, and SCA using tools such as SonarQube and Fortify.
• Conduct cloud security posture assessments across cloud subscriptions.
• Identify cloud misconfigurations, insecure practices, and compliance gaps using Microsoft Defender for Cloud, CSPM, or similar tools.
• Perform threat modelling, risk assessments, security posture assessments, and gap analyses.
• Assess security controls against ISO 27001, NIST Cybersecurity Framework, CIS Benchmarks, and PCI DSS.
• Develop remediation roadmaps with priorities, timelines, and resource requirements.
• Work with development, DevOps, and security teams to triage, prioritize, and remediate vulnerabilities.
• Prepare monthly cloud security posture and remediation reports.
• Prepare quarterly penetration testing and API security reports.

• 3–7+ years of relevant cybersecurity/security assurance experience, ideally with hands-on application, cloud, and DevSecOps security.
• Proven experience in penetration testing and vulnerability assessment.
• Strong experience with API security testing and OWASP API Security Top 10.
• Hands-on experience with Burp Suite Pro, OWASP ZAP, Postman, or similar security testing tools.
• Practical experience implementing DevSecOps and CI/CD security controls.
• Experience with SAST, DAST, and SCA tools such as SonarQube, Fortify, or equivalent.
• Experience conducting cloud security assessments and identifying cloud misconfigurations.
• Knowledge of Microsoft Defender for Cloud, CSPM, or equivalent cloud security platforms.
• Experience with threat modelling, risk assessment, vulnerability management, and remediation validation.
• Good understanding of ISO 27001, NIST CSF, CIS Benchmarks, and PCI DSS.
• Ability to produce professional security assessment, penetration testing, gap analysis, and remediation reports.
• Strong collaboration skills with DevOps, developers, security teams, and business stakeholders.