Information Security Officer / Data Protection Officer

Role Summary

• To establish, implement, maintain, and continually improve the organisation’s Information Security Management System (ISMS), ensuring the confidentiality, integrity, and availability of information assets in compliance with business requirements and applicable legal, regulatory, and contractual obligations.

Key Duties and Responsibilities
Information Security and Data Protection:

• Implement and communicate information security policies, strategies, and procedures.
• Oversee the organisation’s data protection strategy and ensure compliance with applicable data protection laws and regulations.
• Develop and maintain data protection policies and procedures.
• Conduct information security risk assessments and Data Protection Impact Assessments (DPIAs), and implement appropriate risk treatment plans.
• Serve as a point of contact for data subjects, regulatory authorities, and internal stakeholders on data protection matters.
• Manage data subject requests, including access, rectification, and erasure of personal data.
• Monitor compliance with information security and data protection policies through periodic reviews and audits.
• Ensure appropriate security controls are documented and implemented across systems, databases, and the system development life cycle (SDLC).
• Enforce segregation of duties and maker-checker controls across business systems and IT infrastructure.
• Coordinate Vulnerability Assessment and Penetration Testing (VAPT) exercises and other IT audit engagements.

Security Incident Management and Systems Control:

• Establish and maintain procedures for identifying, recording, escalating, resolving, and closing security incidents.
• Monitor security incidents, system malfunctions, and the effectiveness of security controls.
• Conduct daily application server checks to identify unauthorised changes and assess their impact on security and service continuity.
• Perform application and API testing using tools such as Swagger and Postman.
• Develop SQL scripts and queries for End-of-Day (EOD), End-of-Month (EOM), and End-of-Year (EOY) reports.
• Create scheduled jobs to monitor daily processes using Oracle and ACL.
• Identify opportunities to automate processes and improve the effectiveness of security controls.

Enterprise Risk Management and Internal Controls:

• Coordinate with business units to identify risks and implement appropriate controls to mitigate market, credit, operational, and other business risks.
• Coordinate Risk and Control Self-Assessments (RCSAs) and maintain the organisation’s risk register.
• Follow up on outstanding risk and control action items identified during assessments and audits.
• Monitor key risk indicators and prepare quarterly reports.
• Identify emerging risks and recommend appropriate mitigation measures.
• Support the Internal Audit, Internal Control, and Financial Control teams in reviewing accounts and transactions.
• Monitor performance against established targets and report on continual improvement activities.

Other Responsibilities

• Perform any other duties as assigned by the Chief Executive Officer.

Education and Work Experience

• Bachelor’s Degree in Accounting, Finance, Information Technology, Computer Science, or Computer Engineering, with a minimum of Second-Class Upper division.
• At least 5 years of post-qualification experience in Information Security and Data Protection, preferably within the Nigerian capital market.
• Relevant professional certifications, such as CEH, CISA, CRISC, CISM, CIPP, CDPO, or applicable ISO certifications.

Skills and Competencies:

• Knowledge of information security frameworks, cybersecurity, and data protection regulations, particularly the NDPR and applicable Nigerian data protection laws.
• Strong analytical, problem-solving, risk assessment, and reporting skills.
• Technical proficiency in vulnerability assessment, database access controls, SQL, Oracle, ACL, and application/API testing tools.
• Knowledge of Governance, Risk, and Compliance (GRC) tools and internal control frameworks.
• Excellent written and verbal communication skills.

Application Closing Date
3rd November, 2026.

Interested and qualified candidates should send their CV to: resumes@kimberly-ryan.net using “Information Security Officer / Data Protection Officer” as the subject of the email.

Note: Only qualified candidates will be contacted.