Brain Drain Threatens Nigeria’s Cybersecurity Defence – Experts

Nigeria’s efforts to secure its rapidly expanding digital economy are increasingly under threat as the migration of skilled cybersecurity professionals abroad continues to weaken the country’s ability to defend itself against rising cyberattacks.

With cybercriminals intensifying attacks on banks, government institutions and private businesses, industry experts warn that while more young Nigerians are embracing careers in cybersecurity, retaining experienced professionals has become a far greater challenge than attracting new entrants.

As digital services continue to expand across banking, e-commerce, fintech and public services, experts say the country’s cybersecurity capacity is struggling to keep pace with the growing sophistication of cyber threats.

Speaking to LEADERSHIP, Sunday, tech founder and cybersecurity expert, Gbolabo Awelewa, said Nigeria’s digital transformation is advancing much faster than its ability to secure critical systems.

“Payments are digital. Customer records are digital. Government services are following. Each of those shifts opens new ground for attackers, and the people trained to defend that ground are leaving,” he said.

According to Awelewa, Nigerian cybersecurity professionals have become highly sought after in the global labour market, with foreign employers offering salaries and career opportunities that most local organisations cannot match.

“Nigerian cybersecurity professionals are genuinely among the best on the continent, and the international market has noticed. They are being recruited and paid in ways local organisations cannot realistically compete with.

“The result is security teams running on two or three people who are stretched across too many responsibilities, while refusing to outsource,” he said.

He identified weak collaboration between academia and industry as another factor undermining the country’s cybersecurity workforce.

“Universities are graduating people with theoretical knowledge and almost no practical exposure. Certification programmes exist, but the structured career pathways after them do not.

“And when organisations do invest in growing someone, that person is often gone within two years,” he added.

Awelewa stressed that reversing the trend requires coordinated efforts involving government, universities and private sector organisations.

“Fixing this takes more than one policy. It takes academia and industry to build curricula together around what the work actually looks like. It takes organisations creating real career progression for security roles, not just adding a title and a small salary bump.

“And it takes the government treating the cybersecurity workforce the way it treats power infrastructure. A financial sector that cannot staff its own defence is a national liability,” he warned.

Lagos-based IT recruiter Terry Imasuen said demand for cybersecurity professionals has surged across virtually every sector of the economy.

“This is a market crying out for talent. Every bank, fintech and government agency now needs cybersecurity expertise. If you have the right skills, you’ll get noticed quickly,” he said.

With the global shortage of cybersecurity professionals estimated at more than four million vacancies, Nigerian experts are increasingly leveraging their skills for opportunities in international markets.

Imasuen noted that cybersecurity professionals currently earn significantly more than many other technology specialists.

“Cybersecurity offers not only abundant job openings but also competitive pay. In Nigeria, cybersecurity analysts and penetration testers earn, on average, 20 per cent more than software developers with similar experience,” he said.

Cybersecurity instructor Ngozi Nwachukwu said the profession attracts young Nigerians because of both its financial rewards and its strategic importance.

“The earning potential is part of the attraction, but beyond the money, it’s the sense of purpose. You’re protecting people’s data, their businesses and even national systems,” she said.

She added that Nigeria’s expanding digital economy has made cybersecurity indispensable.

“As digital infrastructure expands, the need for digital defence becomes unavoidable. Every new app, every online service is a new attack surface. Young techies see that, and they’re positioning themselves to solve tomorrow’s security challenges.”

Nwachukwu further noted that while other technology fields are becoming increasingly competitive, cybersecurity remains one of the few sectors with a significant talent shortage.

“Cybersecurity isn’t just another tech field; it’s a mission-critical function. When a company loses data, the coder isn’t called first, the cybersecurity team is,” she said.

Despite government efforts to strengthen cybersecurity through policy reforms, certification programmes and strategic partnerships, experts argue that policies alone will not close the widening skills gap.

Industry projections estimate that Nigeria’s cybersecurity market could grow to $345 million by 2029, expanding at more than 10 per cent annually.

However, Awelewa warned that organisations must also address the immediate causes of recent cyber breaches.

“Most of the breaches hitting Nigerian organisations recently trace back to the same two things: poorly secured APIs and vulnerable web applications. As organisations rushed to go digital, development moved fast and security became an afterthought,” he explained.

He noted that many internet-facing applications and API endpoints were deployed without adequate security testing.

“Some return far more data than they should. Some have no authentication requirements at all. Attackers do not need to be clever to exploit that. They need to be patient,” he said.

He also warned that weak security among third-party vendors has become another major source of cyber compromise.

“You can have reasonable internal controls and still get compromised through a vendor or integration partner. Most Nigerian organisations have no formal process for checking that before they go live,” he said.

To strengthen cyber resilience, Awelewa recommended regular web application penetration testing, continuous API security reviews, vendor risk assessments and the integration of secure coding practices throughout software development.