Engineer - Information Security

This company operates under the National Payment System (NPS) Act, providing real-time payment services to address inter-bank money transfer challenges within the country and beyond.

The Information Security Engineer plays a critical role in safeguarding the business payment infrastructure by designing, implementing, and maintaining comprehensive security measures. This involves conducting end-to-end network and application security assessments, integrating security practices into the software development lifecycle (DevSecOps), and ensuring strict adherence to industry regulations such as CBK Cybersecurity Guidelines and PCI DSS. The role also includes optimizing various security tools for maximum effectiveness across both on-premise and cloud environments.

1. Develop and implement secure architectures for new systems and services, adhering to best practices like Zero Trust principles and micro-segmentation, and meeting regulatory requirements.
2. Design and enforce cloud security controls across AWS, Azure, and GCP to protect resources, data, and services.
3. Configure and manage endpoint protection solutions on all devices to prevent malware, viruses, shadow IT, and other security threats.
4. Configure, monitor, and fine-tune security tools such as SIEM, EDR, WAF, and IAM solutions for optimal coverage and timely threat detection.
5. Evaluate emerging security technologies and recommend improvements or replacements.
6. Deploy and manage Zero Trust Network Access (ZTNA) controls for secure access to applications and data, both on-premise and in the cloud, following least privilege and role-based access models.
7. Implement privileged access management (PAM) solutions to enforce least privilege and control access to sensitive systems.
8. Fine-tune and operate vulnerability scanning tools, interpret reports, and prioritize remediation efforts, coordinating patch management with system owners.
9. Perform security hardening of the Google Workspace environment, including configuring security settings, access controls, mobile device management, and data protection.
10. Secure data at rest by implementing secure key management, encryption algorithms, and access controls, including managing cryptographic key lifecycles.
11. Manage the lifecycle of security certificates, including issuance, renewal, and revocation, to ensure integrity and authenticity.
12. Collaborate with infrastructure teams to harden and monitor network devices.
13. Integrate security practices into the software development lifecycle (DevSecOps) with DevOps teams, including secure coding, code reviews, and automated security testing.
14. Conduct API and application security assessments, working with developers on secure coding, threat modeling, and code reviews.
15. Collaborate with cross-functional teams to embed security requirements into software development and infrastructure deployment.
16. Stay current with the latest security trends, threats, and technologies.
17. Identify and lead initiatives to enhance the organization’s overall security posture and resilience.

1. Hold a Bachelor’s Degree in computer science, information security, or a related field.
2. Possess professional certifications such as CISSP, CEH, CISM, or OSCP (advantageous).
3. Have a minimum of 3 years of experience in cybersecurity, preferably within the payments, FinTech, or financial services sectors.
4. Demonstrate practical experience integrating security tools (SIEM, IDS/IPS, EDR) and frameworks (PCI DSS, ISO 27001, NIST).
5. Possess hands-on experience with cloud security platforms (AWS, GCP, or Azure).
6. Exhibit in-depth knowledge of network security concepts (firewalls, routing, network segmentation) and cloud security.
7. Be proficient in security tools and technologies including SIEM, IDS/IPS, EDR, WAF, IAM, and vulnerability scanners.
8. Be familiar with DevSecOps tools and processes (CI/CD pipelines, containerization, automation scripting).
9. Understand modern application security principles (OWASP Top 10, API security, secure coding practices).
10. Have knowledge of operating systems (Windows, Linux) and scripting languages (e.g., Python, Bash).
11. Possess expertise in security assessments and vulnerability management.
12. Demonstrate excellent verbal and written communication skills.
13. Be able to collaborate effectively within cross-functional team environments.
14. Possess strong documentation skills for maintaining security standards and teamwork records.