Expires 4 weeks from now
Information Security Engineer
full-time
Ikoyi,
Lagos
Share this job
Job Summary
Information Security Engineer with 5–6+ years of hands-on experience across Vulnerability Assessment and Penetration Testing (VAPT), Security Operations Centre (SOC), SIEM monitoring, network security, endpoint security and enterprise IT infrastructure. Experienced in assessing and testing web applications, APIs, mobile applications, servers, databases, network devices, cloud environments and enterprise endpoints; identifying security weaknesses; validating exploitability; supporting remediation; and conducting retesting. Strong ability to combine offensive security testing with defensive monitoring and incident detection to provide practical, risk-based security recommendations.
Job Details
Information Security Engineer / VAPT & SOC Engineer
• Conduct end-to-end VAPT across web applications, APIs, mobile applications, network infrastructure, servers, endpoints and enterprise IT assets.
• Perform reconnaissance, enumeration, manual validation, exploitation, privilege escalation and post-exploitation activities within approved testing scope.
• Assess authentication, authorization, session management, access control, business logic, input validation, API security, cryptography and configuration weaknesses.
• Conduct internal and external network penetration tests covering network devices, exposed services, firewalls, VPNs, remote access and segmentation.
• Perform vulnerability scanning and validation; prioritize findings based on severity, exploitability and business impact.
• Produce technical VAPT reports containing evidence, risk ratings, affected assets, remediation recommendations and executive summaries.
• Conduct remediation validation and retesting to confirm vulnerabilities have been effectively closed.
• Support SOC operations through SIEM monitoring, alert investigation, event correlation, threat hunting and escalation of suspected incidents.
• Develop, review and tune SIEM detection use cases, correlation rules, dashboards and alert thresholds.
• Investigate suspicious endpoint, network and authentication activities using SIEM and EDR telemetry.
• Perform security configuration reviews of firewalls, servers, endpoints, Active Directory, cloud resources and critical applications.
• Collaborate with infrastructure, network, application development and IT operations teams to remediate vulnerabilities and strengthen controls.
• Monitored SIEM, EDR and security infrastructure alerts and investigated potential threats and anomalous activities.
• Performed log analysis across authentication, network, endpoint, application and security-device sources.
CORE COMPETENCIES
• Application VAPT: Web Applications, APIs, Mobile Applications, Authentication & Business Logic
• Network VAPT: Internal/External Infrastructure, Firewalls, Routers, Switches, VPNs and Network Services
• Enterprise IT Security Assessment: Servers, Endpoints, Active Directory, Databases, Cloud and Security Devices
• SOC Operations: Security Monitoring, Alert Triage, Incident Investigation, Escalation and Response Support
• SIEM: Log Onboarding, Correlation Rules, Use Cases, Dashboards, Threat Detection and Tuning
• Vulnerability Management: Scanning, Risk Rating, Remediation Tracking and Retesting
• Penetration Testing: Reconnaissance, Enumeration, Exploitation, Privilege Escalation and Reporting
• Threat Detection & Incident Response: IOC Analysis, Threat Hunting, Investigation and Evidence Preservation
• Security Configuration Review: Firewall, OS, Network, Cloud, Endpoint and Application Controls
• Security Reporting: Executive Findings, Technical Reports, Risk-Based Recommendations and Remediation Validation
Requirements
TECHNICAL SKILLS & TOOLS
VAPT / Offensive Security Expected / Preferred Experience :
Burp Suite, Nmap, Nessus/Tenable, Metasploit, Kali Linux, OWASP ZAP, SQLMap, Wireshark
Application Security: OWASP Top 10, OWASP ASVS, API Security, OWASP MASVS/MSTG, SAST/DAST
SOC / SIEM : CrowdStrike Falcon/SIEM, Microsoft Sentinel, Rapid 7, Splunk, QRadar or equivalent
EDR / XDR: CrowdStrike, Microsoft Defender, Sophos or equivalent
Network Security: FortiGate, Sophos, Cisco/enterprise firewalls, VPN, IDS/IPS, NAC, segmentation
Systems: Windows Server, Linux, Active Directory, Entra ID, databases and enterprise applications
Cloud Security: AWS/Azure fundamentals, IAM, logging, security groups and workload security
Scripting / Automation: Python, PowerShell and/or Bash
SELECTED VAPT RESPONSIBILITIES
• Web Application and API Penetration Testing
• Mobile Application Security Testing – Android/iOS
• External and Internal Network Penetration Testing
• Firewall and Network Device Security Assessment
• Server and Endpoint Vulnerability Assessment
• Active Directory and Identity Security Assessment
SIEM / SOC RESPONSIBILITIES
• SIEM deployment support and onboarding of applications, servers, network devices, cloud services and security technologies.
• Creation and tuning of security monitoring use cases for authentication, privilege escalation, malware, data exfiltration, suspicious network activity and configuration changes.
• Threat hunting using endpoint, network, identity and application telemetry.
• Investigation and correlation of alerts across SIEM, EDR/XDR, firewall and identity platforms.
• SOC incident escalation, investigation support, root-cause analysis and lessons learned.
EDUCATION
B.Sc. / B.Tech. Computer Science, Cybersecurity, Information Technology or related discipline
PROFESSIONAL CERTIFICATIONS
• Required / Preferred: SSCP, eJPT, CEH, OSCP or equivalent offensive-security certification
• Preferred: CISSP, CCNA, GIAC, SC-900, CNSP, ITIL or equivalent security certification
• Preferred: ISO/IEC 27001 or related information-security certification
About Company
ARM Holding Company Limited
Asset & Resource Management Company Limited (ARM) was founded in 1994 as an asset management firm.We provide a broad range of unique wealth creation services by offering traditional asset management services as well as alternative investments through our private funds business. ARM currently manages total assets of circa N540 billion. Over the last twenty years, we have built a strong reputation both locally and internationally through in-depth, high-quality research, investment management expertise, and value-adding products and services. Our clients range from corporations to private and public institutions and include high net-worth investors and small savers.