Information Security Officer (On-Site)

Role Overview

We are seeking an experienced Information Security Officer to work fully on-site and lead all security initiatives across our organization. This is a hands-on, office-based role that requires close daily collaboration with engineering, infrastructure, operations, and leadership teams.

The successful candidate will be physically present on-site to conduct security testing, oversee secure development practices, respond to incidents in real time, and drive organization-wide security governance. This role combines deep technical security expertise with strategic leadership, policy development, and risk management responsibilities.

⚠️ This position requires consistent on-site presence and is not open to remote or hybrid work.

Key Responsibilities

Application Security (40%)

• Conduct on-site, hands-on penetration testing of mobile applications (iOS & Android)

• Perform regular API security assessments on Node.js / Express.js backends

• Review application source code for security vulnerabilities alongside developers

• Test for OWASP Mobile Top 10 and OWASP API Top 10 vulnerabilities

• Assess payment processing security and ensure PCI-DSS compliance

• Perform static and dynamic analysis of Flutter applications

• Identify and test business logic vulnerabilities specific to e-commerce platforms

• Implement and maintain application security scanning tools

• Work directly and in-person with development teams to remediate findings

Infrastructure & Cloud Security (20%)

• Secure and monitor cloud infrastructure (AWS)

• Implement and manage centralized security monitoring and logging solutions

• Configure and maintain firewalls, WAFs, IDS/IPS

• Conduct on-site infrastructure security assessments and vulnerability scanning

• Implement and manage secrets management solutions

• Review, harden, and audit server configurations

• Manage SSL/TLS certificates and cryptographic implementations

Security Governance & Risk Management (20%)

• Develop, implement, and enforce information security policies and procedures

• Create, test, and maintain an incident response plan

• Conduct regular on-site security risk assessments across business operations

• Maintain security documentation, audit trails, and compliance records

• Perform vendor security assessments and manage third-party risk

• Ensure compliance with applicable regulations and standards

• Define, track, and report security metrics and KPIs

• Prepare detailed security reports for executive leadership

Security Awareness & Training (10%)

• Deliver in-person security awareness training for employees

• Train developers on secure coding practices through workshops and reviews

• Develop internal security guidelines and best-practice documentation

• Establish and manage a security champions program within engineering teams

• Incident Response & Monitoring (10%)

• Lead on-site security incident response and investigations

• Monitor security alerts, logs, and telemetry for suspicious activity

• Coordinate immediate response to security incidents or data breaches

• Conduct post-incident analysis and implement corrective actions

Required Qualifications

Technical Skills (Must Have)

3+ years of experience in information security or cybersecurity

2+ years of hands-on penetration testing (web and mobile)

Strong expertise in mobile application security (iOS & Android)

Deep knowledge of API security testing and REST API vulnerabilities

Proficiency in Flutter/Dart application security analysis

Strong understanding of Node.js / Express.js security best practices

Cloud security experience (AWS)

Knowledge of authentication mechanisms (JWT, OAuth 2.0)

Solid understanding of cryptography and secure data storage

Security Management Skills (Must Have)

Experience developing and enforcing security policies and procedures

Practical risk assessment and risk management experience

Incident response and digital forensics experience

Vendor and third-party security risk management experience

Nice to Have

• Experience in e-commerce or fintech environments

• Knowledge of payment gateway integrations and security

• Experience implementing DevSecOps practices

• Experience managing or coordinating bug bounty programs

How to Apply

Interested candidates should send their CV with the subject "Information Security Officer" to:

📧 office@lucidweblimited.com

Only candidates based in Abuja or those willing to relocate immediately will be contacted.

<