Intelligence Match
Match: ??%
Unlock Your Personalized Match
Sign in to see your exact score breakdown and personalized insights.
Team Tagline
About the role
Every engineering team at Paystack builds on a shared cloud platform. If that platform is not secure, nothing built on top of it is secure. This role owns that foundation - not as an oversight function or as a policy team but as the engineering layer that makes the platform trustworthy by design. The decisions made here are not team-level decisions. You will own Paystack's AWS organisation end-to-end: its architecture, its account structure, and the organisation-wide controls that govern how every team operates within it. The guardrails you set, the permission model you design, and the security primitives you build are what all engineering teams depend on to do their own work effectively. You are upstream of all of them, and what you build has direct consequences for Paystack's customers, merchants, and regulatory standing across multiple markets. You will inherit a functioning platform and take full ownership of it - improving what exists, completing what was started, and defining what comes next. This is not a role where someone hands you a roadmap. You will identify what needs to be solved before it is articulated, set the technical direction for how platform security works at Paystack, and make architectural decisions with company-wide reach. You will also build the Platform Security function - shaping what it looks like, how it operates, and who it eventually comprises.
Required Skills
Preferred Skills
Responsibilities
- Own the security of Paystack's AWS organisation as a whole - its architecture, account structure and the organisation-level controls that apply across every team, product, and environment at the company
- Design, implement, and govern how access works across the entire organisation - defining the permission model from first principles, building the systems that enforce it, and ensuring it holds as the company scales. Examples of the kind of work this involves include self-service permission services and horizontal access control systems that engineering teams can rely on without needing to involve security on every request
- Define and enforce the cloud security baseline that all engineering teams build within - ensuring that what gets provisioned meets a consistently high standard by default, not by intervention
- Act as the Security team's embedded partner to DevOps - present from the start of infrastructure decisions (not at the end of them) and the central point of contact for security questions from across the engineering organisation
- Ensure that secrets management, identity and access boundaries, and the security of the supply chain at the infrastructure layer are robust, auditable, and well-maintained - providing the foundation that Application Security depends on, without owning its remit
- Own the security observability pipeline up to the point of delivery - ensuring logs and signals are generated correctly, structured for consumption, and reliably delivered to Security Operations, which then owns what is done with them
- Translate compliance requirements across multiple active regulatory frameworks and data protection regimes into concrete, automated infrastructure controls - encryption baselines, access governance, audit logging, and programmatic evidence generation - so that GRC has the technical substance it needs to do its work
- Anticipate where the platform's threat landscape is heading, not just where it has been - building controls that are durable under future conditions, not just the ones you can see today
- Write code that solves real infrastructure security problems with the same rigour you would apply to production engineering - your output is a platform, and it needs to hold
- Make security the path of least resistance for engineering - the controls you build should make the secure option the obvious option, with no trade-off in developer velocity
- Define the technical direction and standards for Platform Security with enough clarity and rigour that they hold as the team grows and as the infrastructure evolves beneath them
Job Application Safety Disclaimer
Your security and privacy are our top priorities. Please be aware that InStreamIQ will never ask you to pay any fees for job applications, placements, or training as a condition of employment.
Furthermore, legitimate employers will not ask for sensitive personal identification such as your Bank Verification Number (BVN), National Identification Number (NIN), or Passport details during the initial application phase. Do not share financial information or make any payments to individuals or organizations claiming to represent an employer. If you encounter any suspicious requests, please report the listing immediately via our support channels.