Information Security Manager

VFD Group is an alternative financial service holding company that creates value by working within Nigeria's informal financial sector to create innovative products and solutions that are accessible to the everyday Nigerian.

We are recruiting to fill the position below:

Job Title: Information Security Manager

Location: Lagos
Employment Type: Full-time

Job Summary

• The Security Manager within the Group Information Security Office (GISO) bridges the gap between strategic governance and technical execution.
• Reporting directly to the Group Chief Information Security Officer (CISO), this role will drive daily security operations, champion compliance initiatives, and ensure the resilience of VFD Group’s ecosystem against emerging threats.

Responsibiities
Daily Security Operations & Tactical Execution:

• Oversee daily security operations across all VFD Group entities, ensuring optimal uptime, coverage, and performance of core security infrastructure (SIEM, EDR, WAF, DLP, and identity controls).
• Manage day-to-day workflow allocation, task prioritization, and deliverable quality for operational security analysts and engineers.
• Enforce operational security baselines, configuration management standards, and change control approvals across cloud (AWS, OCI) and on-premises environments.

Incident Response & Crisis Management:

• Prepare detailed post-incident review reports and execute Corrective and Preventive Action (CAPA) plans to ensure long-term risk elimination.
• Lead the enterprise Incident Response (IR) function, serving as the operational incident commander for medium-to-critical security incidents and threat containment operations.
• Drive post-incident investigations,root-cause analysis (RCA), and digital forensics, ensuring swift containment, eradication, and system recovery.
• Maintain, test, and update Incident Response Plans (IRPs) and playbooks tailored to financial sector threat models (e.g., ransomware, payment fraud, credential stuffing, API abuse).

End-to-End Vulnerability Lifecycle Management:

• Track remediation lifecycles strictly against established SLAs, establishing escalation paths for unpatched vulnerabilities or system configuration drift.
• Validate technical patch efficacy and workarounds implemented by system owners prior to vulnerability ticket closure.
• Prioritize vulnerability remediation based on asset criticality, business context, exploitability, and risk impact in coordination with engineering and IT operations teams.
• assessments, and penetration testing schedules across all subsidiary systems.
• Direct the enterprise vulnerability management program, overseeing automated scanning, manual

Regulatory Compliance & Policy Enforcement:

• Coordinate internal security audits and support external regulatory examinations, facilitating evidence collection and audit response workflows.
• Track and drive the technical remediation of findings stemming from internal/external audits, regulatory reviews, and third-party risk assessments.
• Enforce compliance with enterprise information security policies, standards, and procedures across all group business units.
• Maintain continuous compliance monitoring against applicable financial sector regulations, data privacy laws (e.g., NDPA, GDPR), and security frameworks (ISO 27001, ISO 22301, PCI-DSS, NIST CSF).

Security Awareness & Culture Transformation:

• Establish program metrics to evaluate culture shifts, track completion rates, and reduce human-risk vulnerabilities across the enterprise.
• Execute periodic simulated phishing campaigns, social engineering evaluations, and targeted role-based security training for high-risk personnel (e.g., developers, finance, executives).
• Develop, launch, and manage enterprise-wide security awareness training programs tailored to diverse employee roles across group entities.

CISO Reporting & Strategic Metrics:

• Escalate operational roadblocks, emerging high-severity risks, and resource bottlenecks to the Group CISO with proposed mitigation strategies.
• Provide actionable visibility into the enterprise threat landscape, open vulnerability exposures, incident trends, and control status across all subsidiaries.
• Assist the Group CISO in preparing executive board decks, risk committee summaries, and regulatory status updates.
• Compile, analyze, and present weekly and monthly operational security metrics, Key Performance Indicators (KPIs), and Key Risk Indicators (KRIs) to the Group CISO.

Team Leadership & Cross-Functional Coordination:

• Evaluate vendor security solutions, oversee third-party managed service providers, and manage operational tooling lifecycle management.
• Foster a high-performance,security-first team culture focused on technical rigor, operational efficiency, and clear communication.
• Coordinate cross-functional initiatives alongside IT infrastructure, DevOps, application development, enterprise risk management, internal control, and internal audit leads.

Education/Certifications

• Certified Information Security Manager (CISM)
• Certified Ethical Hacker (CEH)
• Bachelor's or Master's degree in computer science, information security, or a related field.
• Professional certifications such as:
• ISO 27001 Lead Implementer
• Certified Information Systems Security Professional (CISSP)

Experience

• Proven experience managing security engineering, operations, or incident response teams, preferably within financial services or a diversified investment company.
• Relevant certifications (e.g., CISM, CISSP, CISA, or equivalent).
• Master’s degree is an added advantage.
• 8 – 15 years of progressive experience in Cybersecurity, in SOC environments, Governance, Risk & Compliance (GRC), and Cybersecurity Engineering (Application Security, DevSecOps, and Cloud Security)

How to Apply
Interested and qualified candidates should:
Click here to apply online