Information Security Governance Engineer

<h2>Governance &amp; Policy</h2><ul>
<li>Develop, review, and maintain information security policies, standards, procedures, and guidelines.</li>
<li>Ensure alignment with recognized frameworks and standards (e.g. ISO/IEC 27001, PCIDSS, CBN Cybersecurity Framework).</li>
<li>Define security governance structures, roles, and decision‑making processes.</li>
</ul><h2>Risk Management</h2><ul>
<li>Support enterprise information security risk assessments and risk treatment plans.</li>
<li>Maintain the security risk register and track remediation activities.</li>
<li>Advise business units on risk acceptance, mitigation, transfer, or avoidance.</li>
</ul><h2>Compliance &amp; Regulatory Assurance</h2><ul>
<li>Ensure compliance with applicable laws, regulations, and contractual requirements (e.g. NDPR, CBN Cybersecurity Framework, PCI DSS, ISO 27001).</li>
<li>Coordinate internal and external audits, assessments, and certifications.</li>
<li>Track and remediate audit findings and compliance gaps.</li>
</ul><h2>Metrics, Reporting &amp; Assurance</h2><ul>
<li>Define and maintain security governance KPIs, KRIs, and dashboards.</li>
<li>Prepare security posture reports for management, risk committees, and auditors.</li>
<li>Support board‑level and executive reporting on information security matters.</li>
</ul><h2>Third‑Party &amp; Vendor Security Governance</h2><ul>
<li>Support third‑party security risk assessments and due diligence processes.</li>
<li>Review supplier security controls and contractual security clauses.</li>
<li>Monitor ongoing compliance of critical vendors.</li>
</ul><h2>Awareness &amp; Continuous Improvement</h2><ul>
<li>Support security awareness and policy training initiatives.</li>
<li>Monitor regulatory changes and emerging governance trends.</li>
<li>Drive continuous improvement of governance and control maturity.</li>
</ul><h2>Requirements</h2><ul>
<li>Bachelor’s degree in Information Security, Computer Science, Information Technology, or a related field.</li>
<li>Minimum of 5–9 years’ experience in information security governance, risk, and compliance (GRC).</li>
<li>Hands-on experience implementing or managing security frameworks (e.g., ISO 27001, CBN Cybersecurity Framework, NDPR, PCI DSS).</li>
<li>Strong understanding of risk management methodologies and control frameworks.</li>
<li>Experience working with audits, compliance reviews, and regulatory requirements.</li>
<li>Familiarity with security tools and platforms supporting governance and compliance activities.</li>
<li>Experience in financial services, fintech, or telecommunications is an added advantage.</li>
</ul>