Head of Information Security

The Head of Information Security is responsible for defining and leading Piggytech’s information security strategy, protecting its systems, platforms, and data, and ensuring security capabilities support the organisation’s growth and operational resilience.
The role leads the information security function and is accountable for security governance, cybersecurity risk management, security operations, incident response, and security compliance. It oversees the security team, programme delivery, and budget, ensuring resources and investments address the organisation’s most significant security risks.
Working closely with senior management, Engineering, Product, Risk, Compliance, and Legal. The Head of Information Security embeds security into business and technology decisions, provides clear reporting on the organisation’s security posture, and escalates material risks for appropriate action.

Security Strategy & Programme Leadership

• Develop and maintain Piggytech’s information security roadmap, aligning security priorities with business objectives, regulatory requirements, and emerging threats.
• Develop the cybersecurity strategy and programme for approval through the appropriate governance process, and lead implementation of the Board-approved strategy.
• Lead the planning and delivery of security initiatives, including ISO 27001, security contributions to ISO 22301, vulnerability assessments, and cybersecurity improvement programmes.
• Define project scope, ownership, timelines, and resource requirements, and track delivery against agreed objectives.
• Develop and manage the information security budget, recommending security investments, tools, and improvements based on risk, business needs, and effectiveness.

Team Leadership & Development

• Lead the information security team, setting clear objectives, assigning responsibilities, and reviewing the quality and timeliness of work.
• Provide technical guidance, coaching, and mentorship to strengthen the team’s capabilities.
• Manage team performance, identify development needs, and support recruitment and onboarding within the function.
• Establish clear operating procedures, escalation paths, and coverage arrangements for security monitoring and incident response.
• Ensure team members maintain relevant technical knowledge and participate in appropriate professional development.

Security Operations & Incident Response

• Oversee security monitoring across applications, cloud infrastructure, networks, endpoints, and internal systems.
• Ensure security alerts are investigated, prioritised, and resolved within agreed timelines.
• Lead the response to significant security incidents, coordinating investigation, containment, recovery, and communication with relevant stakeholders.
• Maintain incident response plans and playbooks, and conduct exercises to assess readiness.
• Ensure incident records and relevant evidence are preserved to support investigations and reporting.
• Lead post-incident reviews, ensuring root causes are addressed and corrective actions are completed.

Cybersecurity Risk Management

• Lead cybersecurity risk assessments across systems, business processes, new products, and significant technology changes.
• Maintain the cybersecurity risk register and ensure risks have clear owners, treatment plans, and review timelines.
• Evaluate the effectiveness of security controls and drive improvements where gaps are identified.
• Align cybersecurity risk management with the organisation’s enterprise risk management framework and approved risk appetite.
• Escalate material risks and overdue remediation actions to senior management and the relevant Board committee, and obtain documented approval for risk acceptance where required.

Security Architecture & Implementation

• Partner with Technology and Product teams to embed security requirements into system design, development, deployment, and change management.
• Review the security of applications, APIs, cloud environments, and integrations, recommending practical improvements.
• Oversee controls for identity and access management, privileged access, secure configuration, encryption, secrets management, and data protection.
• Establish security review requirements for new systems and major changes, and track identified issues through resolution.

Vulnerability Management & Security Assurance

• Lead the vulnerability management programme, including internal and external assessments, penetration testing, and remediation tracking.
• Prioritise vulnerabilities based on severity, exposure, and business impact, and agree remediation timelines with responsible teams.
• Verify that remediation actions are effective and escalate unresolved vulnerabilities where necessary.
• Coordinate security audits and assessments, ensuring findings are addressed and supporting evidence is maintained.

Security Governance, Compliance & Policies

• Maintain and improve information security policies, standards, procedures, and supporting documentation.
• Lead security activities supporting applicable CBN cybersecurity frameworks, guidelines and directives, the Nigeria Data Protection Act, PCI DSS where applicable, and other relevant regulatory and industry requirements.
• Work with Risk, Compliance, Legal, and relevant data protection stakeholders to align security controls with compliance obligations.
• Coordinate security inputs into regulatory reviews, certification activities, and internal and external audits.
• Coordinate required cybersecurity incident notifications, regulatory reports, and submissions with Compliance and Legal, ensuring applicable reporting timelines are met.
• Track security-related regulatory findings and commitments, ensuring corrective actions are completed and appropriately documented.

Third-Party Security & Operational Resilience

• Oversee security assessments of vendors, service providers, and third-party integrations, working with relevant business owners to address identified risks.
• Review security requirements for third-party access, data handling, and contractual commitments.
• Monitor material third-party security risks and follow up on agreed remediation actions.
• Support business continuity and disaster recovery planning, ensuring security considerations are included in recovery procedures and testing.

Security Advisory & Awareness

• Serve as a primary point of contact for information security advice across the organisation.
• Lead security awareness initiatives and targeted training based on employee responsibilities, observed risks, and incident trends.
• Promote timely reporting of security concerns and clear accountability for security responsibilities across teams.

Management Reporting & Continuous Improvement

• Define and report security metrics covering incident response, vulnerability remediation, control effectiveness, audit findings, and programme delivery.
• Provide senior management with clear updates on the organisation’s security posture, material risks, resource needs, and recommended actions.
• Present periodic cybersecurity reports to the CEO and relevant Board committee, covering material risks, significant incidents, control effectiveness, remediation progress, and resource requirements.
• Monitor emerging threats and changes in the business and technology environment, adapting security priorities accordingly.
• Assess the maturity of the information security programme and track improvements against agreed priorities.

Requirements

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, Information Systems, or a related discipline.
• At least ten years of relevant experience across information security, cybersecurity, information technology, IT risk management, information security risk management, or IT audit, with substantial responsibility for cybersecurity governance and the implementation of security controls.
• At least three years in a senior information security leadership role, with responsibility for leading teams, managing security programmes and budgets, and reporting material security risks to executive management or Board committees.
• Must hold at least one current professional information security certification: Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), or Certified Chief Information Security Officer (CCISO).
• Additional certifications, such as ISO 27001 Lead Implementer or Lead Auditor, are an added advantage.
• Experience in financial services, fintech, payments, or another regulated environment, with demonstrated understanding of the security risks associated with digital financial services.
• Demonstrated experience across security operations, incident response, vulnerability management, cloud security, application and API security, identity and access management, and cybersecurity risk management.
• Experience developing and implementing information security strategies, policies, risk assessment processes, and incident response arrangements.
• Experience implementing or maintaining an information security management system and leading security audits, regulatory examinations, or certification programmes.
• Working knowledge of applicable CBN cybersecurity frameworks, guidelines and directives; the Nigeria Data Protection Act; ISO 27001; business continuity requirements under ISO 22301; and PCI DSS, where applicable.
• Experience engaging with regulators, auditors, executive management, and Board committees, including presenting security risks, remediation plans, and investment recommendations.

Key Skills & Competencies

• Strong technical judgment and ability to prioritise security work based on business risk.
• Practical experience with SIEM, endpoint security, vulnerability assessment, and cloud security tools.
• Strong understanding of application and API security, secure development practices, and identity and access management.
• Ability to develop security strategies and translate them into practical plans, controls, and measurable outcomes.
• Ability to lead teams, manage budgets and competing priorities, and drive delivery across functions.
• Strong investigation, problem-solving, and decision-making skills.
• Clear communication skills, including the ability to explain technical risks and recommendations to non-technical stakeholders.
• Ability to provide independent advice, challenge control weaknesses, and escalate material concerns appropriately.