Jobs at VFD Group

Job Summary

• The Security Manager within the Group Information Security Office (GISO) bridges the gap between strategic governance and technical execution.
• Reporting directly to the Group Chief Information Security Officer (CISO), this role will drive daily security operations, champion compliance initiatives, and ensure the resilience of VFD Group’s ecosystem against emerging threats.

Responsibiities
Daily Security Operations & Tactical Execution:

• Oversee daily security operations across all VFD Group entities, ensuring optimal uptime, coverage, and performance of core security infrastructure (SIEM, EDR, WAF, DLP, and identity controls).
• Manage day-to-day workflow allocation, task prioritization, and deliverable quality for operational security analysts and engineers.
• Enforce operational security baselines, configuration management standards, and change control approvals across cloud (AWS, OCI) and on-premises environments.

Incident Response & Crisis Management:

• Lead the enterprise Incident Response (IR) function, serving as the operational incident commander for medium-to-critical security incidents and threat containment operations.
• Drive post-incident investigations,root-cause analysis (RCA), and digital forensics, ensuring swift containment, eradication, and system recovery.
• Maintain, test, and update Incident Response Plans (IRPs) and playbooks tailored to financial sector threat models (e.g., ransomware, payment fraud, credential stuffing, API abuse).
• Prepare detailed post-incident review reports and execute Corrective and Preventive Action (CAPA) plans to ensure long-term risk elimination.

End-to-End Vulnerability Lifecycle Management:

• Direct the enterprise vulnerability management program, overseeing automated scanning, manual
• assessments, and penetration testing schedules across all subsidiary systems.
• Prioritize vulnerability remediation based on asset criticality, business context, exploitability, and risk impact in coordination with engineering and IT operations teams.
• Track remediation lifecycles strictly against established SLAs, establishing escalation paths for unpatched vulnerabilities or system configuration drift.
• Validate technical patch efficacy and workarounds implemented by system owners prior to vulnerability ticket closure.

Regulatory Compliance & Policy Enforcement:

• Maintain continuous compliance monitoring against applicable financial sector regulations, data privacy laws (e.g., NDPA, GDPR), and security frameworks (ISO 27001, ISO 22301, PCI-DSS, NIST CSF).
• Coordinate internal security audits and support external regulatory examinations, facilitating evidence collection and audit response workflows.
• Track and drive the technical remediation of findings stemming from internal/external audits, regulatory reviews, and third-party risk assessments.
• Enforce compliance with enterprise information security policies, standards, and procedures across all group business units.

Security Awareness & Culture Transformation:

• Develop, launch, and manage enterprise-wide security awareness training programs tailored to diverse employee roles across group entities.
• Execute periodic simulated phishing campaigns, social engineering evaluations, and targeted role-based security training for high-risk personnel (e.g., developers, finance, executives).
• Establish program metrics to evaluate culture shifts, track completion rates, and reduce human-risk vulnerabilities across the enterprise.

CISO Reporting & Strategic Metrics:

• Compile, analyze, and present weekly and monthly operational security metrics, Key Performance Indicators (KPIs), and Key Risk Indicators (KRIs) to the Group CISO.
• Provide actionable visibility into the enterprise threat landscape, open vulnerability exposures, incident trends, and control status across all subsidiaries.
• Assist the Group CISO in preparing executive board decks, risk committee summaries, and regulatory status updates.
• Escalate operational roadblocks, emerging high-severity risks, and resource bottlenecks to the Group CISO with proposed mitigation strategies.

Team Leadership & Cross-Functional Coordination:

• Foster a high-performance,security-first team culture focused on technical rigor, operational efficiency, and clear communication.
• Coordinate cross-functional initiatives alongside IT infrastructure, DevOps, application development, enterprise risk management, internal control, and internal audit leads.
• Evaluate vendor security solutions, oversee third-party managed service providers, and manage operational tooling lifecycle management.

Education/Certifications

• Bachelor's or Master's degree in computer science, information security, or a related field.
• Professional certifications such as:
• Certified Information Systems Security Professional (CISSP)
• Certified Ethical Hacker (CEH)
• Certified Information Security Manager (CISM)
• ISO 27001 Lead Implementer

Experience:

• 8 – 15 years of progressive experience in Cybersecurity, in SOC environments, Governance, Risk & Compliance (GRC), and Cybersecurity Engineering (Application Security, DevSecOps, and Cloud Security)
• Master’s degree is an added advantage.
• Relevant certifications (e.g., CISM, CISSP, CISA, or equivalent).
• Proven experience managing security engineering, operations, or incident response teams, preferably within financial services or a diversified investment company.

go to method of application »

Job Summary

• The Senior Security Engineer is a high-impact technical lead responsible for evaluating,testing,and validating the effectiveness of the Group’s cybersecurity controls,data privacy frameworks,and technical architectures across all subsidiary operations.
• This role leads technical risk assessments—including penetration testing,vulnerability scanning,Data Protection Impact Assessments (DPIAs),and threat modelling—to proactively identify security gaps in cloud,on-premise,and application environments.

Responsibities
Security Assurance & Architecture Assessment:

• Evaluate defense-in-depth frameworks across VFD Group's financial services and subsidiary ecosystem to validate control effectiveness and identify coverage gaps.
• Perform risk-based architecture reviews,threat modeling assessments,and security design evaluations for new software platforms,infrastructure,and third-party integrations.
• Audit and assure technical architectures against regulatory requirements,industry benchmarks (e.g.,ISO 27001,PCI-DSS,NIST CSF),and internal security policies.

Vulnerability & Penetration Testing:

• Plan,scope,and execute comprehensive vulnerability assessments across cloud,hybrid,and on-premise infrastructure,API endpoints,and web/mobile applications.
• Conduct ethical hacking and internal/external penetration testing to proactively identify exploit paths,logic flaws,and privilege escalation vulnerabilities.
• Perform SAST/DAST reviews and source code security audits to validate application resilience before production deployment.

Data Protection & Privacy Assurance:

• Conduct Data Protection Impact Assessments (DPIAs) and privacy compliance reviews for new systems,data workflows,and third-party integrations processing sensitive customer data.
• Validate the technical implementation of data classification,encryption-at-rest/in-transit,loss prevention (DLP),and access controls in accordance with NDPA,GDPR,and enterprise policies.
• Assess data retention,anonymization,and secure destruction practices across group entities to mitigate data exposure risks.

Cloud & Infrastructure Security Governance:

• Assess multi-cloud (AWS,Azure) and on-premise environments to verify compliance with identity and access management (IAM),encryption,and network segmentation standards.
• Evaluate DevSecOps automation and CI/CD security gating,assuring that infrastructure-as-code deployments adhere to security baselines.

Incident Review & Diagnostic Assurance:

• Conduct independent post-incident reviews,forensic audits,and root-cause analyses for severe security events to validate remediation efficacy.
• Analyze threat vectors,forensic artifacts,and telemetry logs during investigations to ensure threat containment and control validation.
• Review post-incident reports to verify that corrective and preventive action plans (CAPAs) are actionable and fully implemented.

Standards & Compliance Testing:

• Establish baseline security compliance checklists for operating systems,containerized environments,and network infrastructure.
• Assess adherence to secure coding practices and application security standards across engineering teams.
• Execute periodic compliance audits and continuous monitoring assessments to detect,track,and remediate configuration drift.

Tooling & Control Effectiveness Evaluation:

• Assess the coverage,configuration quality,and operational readiness of core security stack tools (SIEM,EDR,WAF,DLP,and vulnerability management platforms).
• Validate the accuracy and coverage of automated threat detection rules,alert logic,and SOC playbooks to minimize false negatives and positives.
• Evaluate emerging security technologies and third-party vendor solutions to assure alignment with group security requirements.

Risk Validation & Audit Remediation:

• Translate enterprise risk findings,vulnerability assessments,penetration testing results,and regulatory audit findings into prioritized technical remediation roadmaps.
• Validate the implementation and operational effectiveness of technical mitigations introduced by engineering teams.
• Track,report,and present technical Key Risk Indicators (KRIs),Key Performance Indicators (KPIs),and control maturity metrics to executive leadership and risk committees.

Advisory & Technical Assurance Guidance:

• Deliver technical advisory and mentorship to junior analysts,audit peers,and engineering leads on security controls and risk mitigation strategies.
• Conduct independent reviews of security assessment findings,pentest reports,and privacy evaluations alongside development and operations teams.
• Drive continuous security assurance awareness across subsidiaries through targeted technical assessment workshops and policy reviews.

Specification & Qualifications
Education/Certification:

• Bachelor's or Master's Degree in Computer Science, Information Security, or a related field.
• Certified Information Systems Security Professional (CISSP)
• Certified Ethical Hacker (CEH)
• AWS Certified Solution Architect
• AWS Certified Security Specialty
• Microsoft Certified Azure Security Engineer
• OCI Certified Security Professional

Experience:

• 6 - 8 years of proven experience in computing and information security, including experience in Fintech, Banking or Mobile Money is preferred
• Strong understanding of emerging technologies, cloud computing, and mobile security.
• Familiarity with risk management methodologies and techniques.
• Excellent leadership and management skills, with the ability to inspire and motivate cross-functional teams.
• Demonstrated ability to work in a fast-paced and dynamic environment, balancing multiple priorities and deadline.