View and Apply for More:

Job Title: Head of Information Security
Company: Piggytech Global Limited – PiggyVest
Location: Victoria Island, Lagos
Employment Type: Full-time

Piggytech Global Limited is a financial technology company focused on giving individuals the power to better manage and grow their finances. Through its financial products and services, the company aims to make saving, investing and managing money more accessible while building trust and delivering value to its customers.

Piggytech is committed to providing a progressive and open-minded work environment built around diversity, openness and collaboration. The company encourages teamwork, professional development and innovation as it continues to expand its products and strengthen its position in the financial technology sector.

Job Summary

Piggytech Global Limited is seeking to recruit an experienced Head of Information Security to define and lead its information security strategy, protect its systems, platforms and data, and ensure that security capabilities support organisational growth and operational resilience.

The successful candidate will lead the information security function, overseeing security governance, cybersecurity risk management, security operations, incident response and regulatory compliance. The role also involves managing the security team, programmes and budget while working closely with senior management and cross-functional teams to embed security into business and technology decisions.

Key Responsibilities

Security Strategy and Programme Leadership

Develop and maintain Piggytech’s information security roadmap, aligning security priorities with business objectives, regulatory requirements and emerging threats.
Develop the cybersecurity strategy and programme for approval through the appropriate governance process and lead implementation of the Board-approved strategy.
Lead security initiatives, including ISO 27001, security contributions to ISO 22301, vulnerability assessments and cybersecurity improvement programmes.
Define project scope, ownership, timelines and resource requirements, monitoring delivery against agreed objectives.
Develop and manage the information security budget, recommending investments, tools and improvements based on risk and business needs.

Team Leadership and Development

Lead the information security team, setting clear objectives, assigning responsibilities and reviewing work quality and delivery.
Provide technical guidance, coaching and mentorship to strengthen team capabilities.
Manage team performance, identify development needs and support recruitment and onboarding.
Establish operating procedures, escalation paths and coverage arrangements for security monitoring and incident response.
Ensure team members maintain relevant technical knowledge and participate in professional development.

Security Operations and Incident Response

Oversee security monitoring across applications, cloud infrastructure, networks, endpoints and internal systems.
Ensure security alerts are investigated, prioritised and resolved within agreed timelines.
Lead responses to significant security incidents, coordinating investigation, containment, recovery and stakeholder communication.
Maintain incident response plans and playbooks and conduct exercises to assess organisational readiness.
Ensure incident records and relevant evidence are preserved for investigations and reporting.
Lead post-incident reviews and ensure root causes are addressed and corrective actions completed.

Cybersecurity Risk Management

Lead cybersecurity risk assessments across systems, business processes, new products and significant technology changes.
Maintain the cybersecurity risk register, ensuring risks have clear owners, treatment plans and review timelines.
Evaluate security controls and drive improvements where gaps are identified.
Align cybersecurity risk management with the enterprise risk management framework and approved risk appetite.
Escalate material risks and overdue remediation actions to senior management and relevant Board committees.
Obtain documented approval for risk acceptance where required.

Security Architecture and Implementation

Work with Technology and Product teams to embed security requirements into system design, development, deployment and change management.
Review the security of applications, APIs, cloud environments and integrations, recommending practical improvements.
Oversee identity and access management, privileged access, secure configuration, encryption, secrets management and data protection controls.
Establish security review requirements for new systems and major changes, tracking identified issues through resolution.

Vulnerability Management and Security Assurance

Lead the vulnerability management programme, including internal and external assessments, penetration testing and remediation tracking.
Prioritise vulnerabilities based on severity, exposure and business impact, agreeing remediation timelines with responsible teams.
Verify remediation effectiveness and escalate unresolved vulnerabilities where necessary.
Coordinate security audits and assessments, ensuring findings are addressed and supporting evidence is maintained.

Security Governance, Compliance and Policies

Maintain and improve information security policies, standards, procedures and supporting documentation.
Lead security activities supporting applicable CBN cybersecurity frameworks, guidelines and directives, the Nigeria Data Protection Act, PCI DSS where applicable, and other relevant regulatory requirements.
Work with Risk, Compliance, Legal and data protection stakeholders to align security controls with compliance obligations.
Coordinate security inputs into regulatory reviews, certification activities and internal and external audits.
Coordinate required cybersecurity incident notifications, regulatory reports and submissions with Compliance and Legal.
Track security-related regulatory findings and commitments, ensuring corrective actions are completed and documented.

Third-Party Security and Operational Resilience

Oversee security assessments of vendors, service providers and third-party integrations.
Review security requirements relating to third-party access, data handling and contractual commitments.
Monitor material third-party security risks and follow up on remediation actions.
Support business continuity and disaster recovery planning, ensuring security considerations are incorporated into recovery procedures and testing.

Security Advisory and Awareness

Serve as a primary point of contact for information security advice across the organisation.
Lead security awareness initiatives and targeted training based on employee responsibilities, observed risks and incident trends.
Promote timely reporting of security concerns and accountability for security responsibilities across teams.

Management Reporting and Continuous Improvement

Define and report security metrics covering incident response, vulnerability remediation, control effectiveness, audit findings and programme delivery.
Provide senior management with updates on the organisation’s security posture, material risks, resource needs and recommended actions.
Present periodic cybersecurity reports to the CEO and relevant Board committee, covering significant incidents, control effectiveness, remediation progress and resource requirements.
Monitor emerging threats and changes in the business and technology environment, adapting security priorities accordingly.
Assess the maturity of the information security programme and track improvements against agreed priorities.

Qualifications and Experience

Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, Information Systems or a related discipline.
At least 10 years of relevant experience across information security, cybersecurity, information technology, IT risk management, information security risk management or IT audit, with substantial responsibility for cybersecurity governance and security control implementation.
At least 3 years in a senior information security leadership role, with responsibility for leading teams, managing security programmes and budgets, and reporting material security risks to executive management or Board committees.
Must hold at least one current professional information security certification: Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM) or Certified Chief Information Security Officer (CCISO).
Additional certifications, such as ISO 27001 Lead Implementer or Lead Auditor, are an added advantage.
Experience in financial services, fintech, payments or another regulated environment, with an understanding of digital financial services security risks.
Demonstrated experience in security operations, incident response, vulnerability management, cloud security, application and API security, identity and access management, and cybersecurity risk management.
Experience developing and implementing information security strategies, policies, risk assessment processes and incident response arrangements.
Experience implementing or maintaining an information security management system and leading security audits, regulatory examinations or certification programmes.
Working knowledge of applicable CBN cybersecurity frameworks, guidelines and directives; the Nigeria Data Protection Act; ISO 27001; ISO 22301 business continuity requirements; and PCI DSS, where applicable.
Experience engaging with regulators, auditors, executive management and Board committees, including presenting security risks, remediation plans and investment recommendations.

Required Skills and Competencies

Strong technical judgement and ability to prioritise security activities based on business risk.
Practical experience with Security Information and Event Management (SIEM), endpoint security, vulnerability assessment and cloud security tools.
Strong understanding of application and API security, secure development practices, and identity and access management.
Ability to develop security strategies and translate them into practical plans, controls and measurable outcomes.
Strong team leadership, budget management and cross-functional project delivery skills.
Excellent investigation, problem-solving and decision-making abilities.
Clear communication skills, including the ability to explain technical risks and recommendations to non-technical stakeholders.
Ability to provide independent advice, challenge control weaknesses and escalate material concerns appropriately.

How to Apply

Interested and qualified candidates should apply online through the Piggytech Global Limited recruitment portal.

Application Link: https://piggytech.seamlesshiring.com/job/view/11400#/

Application Closing Date

Not Specified.