The Role
Lead information security governance, risk, and compliance activities. Develop and maintain policies and standards, manage risk assessments and registers, coordinate audits and regulatory compliance, track remediation, report security metrics to executives, assess third-party security risks, support awareness initiatives, and drive continuous improvement across governance and control frameworks.
Summary Generated by Built In
Governance & Policy
- Develop, review, and maintain information security policies, standards, procedures, and guidelines.
- Ensure alignment with recognized frameworks and standards (e.g. ISO/IEC 27001, PCIDSS, CBN Cybersecurity Framework).
- Define security governance structures, roles, and decision‑making processes.
Risk Management
- Support enterprise information security risk assessments and risk treatment plans.
- Maintain the security risk register and track remediation activities.
- Advise business units on risk acceptance, mitigation, transfer, or avoidance.
Compliance & Regulatory Assurance
- Ensure compliance with applicable laws, regulations, and contractual requirements (e.g. NDPR, CBN Cybersecurity Framework, PCI DSS, ISO 27001).
- Coordinate internal and external audits, assessments, and certifications.
- Track and remediate audit findings and compliance gaps.
Metrics, Reporting & Assurance
- Define and maintain security governance KPIs, KRIs, and dashboards.
- Prepare security posture reports for management, risk committees, and auditors.
- Support board‑level and executive reporting on information security matters.
Third‑Party & Vendor Security Governance
- Support third‑party security risk assessments and due diligence processes.
- Review supplier security controls and contractual security clauses.
- Monitor ongoing compliance of critical vendors.
Awareness & Continuous Improvement
- Support security awareness and policy training initiatives.
- Monitor regulatory changes and emerging governance trends.
- Drive continuous improvement of governance and control maturity.
Requirements
- Bachelor’s degree in Information Security, Computer Science, Information Technology, or a related field.
- Minimum of 5–9 years’ experience in information security governance, risk, and compliance (GRC).
- Hands-on experience implementing or managing security frameworks (e.g., ISO 27001, CBN Cybersecurity Framework, NDPR, PCI DSS).
- Strong understanding of risk management methodologies and control frameworks.
- Experience working with audits, compliance reviews, and regulatory requirements.
- Familiarity with security tools and platforms supporting governance and compliance activities.
- Experience in financial services, fintech, or telecommunications is an added advantage.
Skills Required
- Bachelor's degree in Information Security, Computer Science, Information Technology, or a related field.
- 5-9 years of experience in information security governance, risk, and compliance.
- Hands-on experience implementing or managing ISO 27001, CBN Cybersecurity Framework, NDPR, or PCI DSS.
- Strong understanding of risk management methodologies and control frameworks.
- Experience with audits, compliance reviews, and regulatory requirements.
- Familiarity with security tools and platforms supporting governance and compliance activities.
- Experience in financial services, fintech, or telecommunications.
Am I A Good Fit?
Get Personalized Job Insights.
Our AI-powered fit analysis compares your resume with a job listing so you know if your skills & experience align.
Success! Refresh the page to see how your skills align with this role.
The Company
What We Do
At Renmoney, we believe finance should be simple, useful and accessible to everyone. That’s what makes us really passionate about leveraging data driven insights to help us understand you better and build useful financial products for your personal and business needs - like convenient loans to help you do more today, savings to keep you on track for your goals and investments that’ll generate more money for you. We run a hybrid work model with some of our employees working fully remote and others working remotely and coming into the office a few times a week.
