Senior Security Engineer at VFD Group

Job Summary

• The Senior Security Engineer is a high-impact technical lead responsible for evaluating,testing,and validating the effectiveness of the Group’s cybersecurity controls,data privacy frameworks,and technical architectures across all subsidiary operations.
• This role leads technical risk assessments—including penetration testing,vulnerability scanning,Data Protection Impact Assessments (DPIAs),and threat modelling—to proactively identify security gaps in cloud,on-premise,and application environments.

Responsibities
Security Assurance & Architecture Assessment:

• Evaluate defense-in-depth frameworks across VFD Group's financial services and subsidiary ecosystem to validate control effectiveness and identify coverage gaps.
• Perform risk-based architecture reviews,threat modeling assessments,and security design evaluations for new software platforms,infrastructure,and third-party integrations.
• Audit and assure technical architectures against regulatory requirements,industry benchmarks (e.g.,ISO 27001,PCI-DSS,NIST CSF),and internal security policies.

Vulnerability & Penetration Testing:

• Plan,scope,and execute comprehensive vulnerability assessments across cloud,hybrid,and on-premise infrastructure,API endpoints,and web/mobile applications.
• Conduct ethical hacking and internal/external penetration testing to proactively identify exploit paths,logic flaws,and privilege escalation vulnerabilities.
• Perform SAST/DAST reviews and source code security audits to validate application resilience before production deployment.

Data Protection & Privacy Assurance:

• Conduct Data Protection Impact Assessments (DPIAs) and privacy compliance reviews for new systems,data workflows,and third-party integrations processing sensitive customer data.
• Validate the technical implementation of data classification,encryption-at-rest/in-transit,loss prevention (DLP),and access controls in accordance with NDPA,GDPR,and enterprise policies.
• Assess data retention,anonymization,and secure destruction practices across group entities to mitigate data exposure risks.

Cloud & Infrastructure Security Governance:

• Assess multi-cloud (AWS,Azure) and on-premise environments to verify compliance with identity and access management (IAM),encryption,and network segmentation standards.
• Evaluate DevSecOps automation and CI/CD security gating,assuring that infrastructure-as-code deployments adhere to security baselines.

Incident Review & Diagnostic Assurance:

• Conduct independent post-incident reviews,forensic audits,and root-cause analyses for severe security events to validate remediation efficacy.
• Analyze threat vectors,forensic artifacts,and telemetry logs during investigations to ensure threat containment and control validation.
• Review post-incident reports to verify that corrective and preventive action plans (CAPAs) are actionable and fully implemented.

Standards & Compliance Testing:

• Establish baseline security compliance checklists for operating systems,containerized environments,and network infrastructure.
• Assess adherence to secure coding practices and application security standards across engineering teams.
• Execute periodic compliance audits and continuous monitoring assessments to detect,track,and remediate configuration drift.

Tooling & Control Effectiveness Evaluation:

• Assess the coverage,configuration quality,and operational readiness of core security stack tools (SIEM,EDR,WAF,DLP,and vulnerability management platforms).
• Validate the accuracy and coverage of automated threat detection rules,alert logic,and SOC playbooks to minimize false negatives and positives.
• Evaluate emerging security technologies and third-party vendor solutions to assure alignment with group security requirements.

Risk Validation & Audit Remediation:

• Translate enterprise risk findings,vulnerability assessments,penetration testing results,and regulatory audit findings into prioritized technical remediation roadmaps.
• Validate the implementation and operational effectiveness of technical mitigations introduced by engineering teams.
• Track,report,and present technical Key Risk Indicators (KRIs),Key Performance Indicators (KPIs),and control maturity metrics to executive leadership and risk committees.

Advisory & Technical Assurance Guidance:

• Deliver technical advisory and mentorship to junior analysts,audit peers,and engineering leads on security controls and risk mitigation strategies.
• Conduct independent reviews of security assessment findings,pentest reports,and privacy evaluations alongside development and operations teams.
• Drive continuous security assurance awareness across subsidiaries through targeted technical assessment workshops and policy reviews.

Specification & Qualifications
Education/Certification:

• Bachelor's or Master's Degree in Computer Science, Information Security, or a related field.
• Certified Information Systems Security Professional (CISSP)
• Certified Ethical Hacker (CEH)
• AWS Certified Solution Architect
• AWS Certified Security Specialty
• Microsoft Certified Azure Security Engineer
• OCI Certified Security Professional

Experience:

• 6 - 8 years of proven experience in computing and information security, including experience in Fintech, Banking or Mobile Money is preferred
• Strong understanding of emerging technologies, cloud computing, and mobile security.
• Familiarity with risk management methodologies and techniques.
• Excellent leadership and management skills, with the ability to inspire and motivate cross-functional teams.
• Demonstrated ability to work in a fast-paced and dynamic environment, balancing multiple priorities and deadline.