Information Security Officer

About the role

The Information Security Officer (ISO) is responsible for reviewing and monitoring the organization’s information security framework to protect data assets, ensure regulatory compliance, and mitigate security risks. The ISO works closely with IT teams to align security practices with organizational objectives, regulatory requirements, and industry best practices.

Key responsibilities

• Identify, assess, and report information security risks and coordinate remediation plans.
• Conduct periodic information security risk assessments and vulnerability assessments.
• Ensure compliance with NAICOM, NDPR, CBN, and other regulatory requirements related to information security and data privacy.
• Collaborate with Risk and Compliance teams to embed security controls into enterprise risk frameworks.
• Monitor third‑party/vendor information security risks.
• Design and deliver periodic information security awareness programs for staff.
• Lead investigations into actual or suspected security breaches and coordinate response actions.
• Maintain records of incidents, root causes, and corrective actions.
• Provide quarterly information security reports to management and the Board Risk Committee.
• Work with IT to implement technical and administrative security controls such as firewalls, encryption, and access management.
• Liaise with internal audit, regulators, and external assessors on information security audits and reviews.
• Uphold the highest standards of confidentiality in handling company‑related information and ensure compliance with data protection laws.

Required profile

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a related field.
• Professional certification in information security (e.g., CISM, CISSP, ISO 27001 Lead Implementer/Auditor, CEH).
• Minimum of 3–5 years relevant experience in information security, risk management, or IT audit, preferably within financial services or insurance.
• Strong understanding of NDPR, NAICOM guidelines, CBN risk‑based supervision framework, and global cybersecurity standards.
• High level of integrity, confidentiality, and professionalism.

Required skills

• Firewalls
• Encryption
• Access Management