Technology, Platforms & Operational Risk Manager

Company Description: Heirs Technologies is a privately held technology firm that helps African organisations navigate complex digital transformation journeys. The company provides cybersecurity, digital trust, managed services, data and AI, and cloud solutions tailored to local needs and market realities. With a focus on combining world-class expertise with accessible support, Heirs Technologies partners with clients to modernise operations and strengthen resilience. The firm also invests in building the next generation of technical engineers, supporting long-term careers in technology across the continent. Team members join a mission-driven environment dedicated to shaping Africa’s digital and innovation future.

Value to HT: Every platform and managed service HT sells is proven safe to run before it is switched on, resists fraud and misuse while clients depend on it, and the engineers who touch client systems are vetted and controlled.

What the business gets

• Managed services, cloud, SOC and products (₦9.3bn) run on tested controls, so outages, SLA credits and client exits are prevented rather than explained

• No go-live or service takeover without tested recovery, security testing, a data protection assessment and named owners

• Platforms that pass bank and regulator scrutiny on payments rules, fraud controls and resilience before launch, with fraud managed as a measured risk

• Privileged and client access that is approved, reviewed every quarter and removed on the day someone leaves; screening verified for everyone with client access

• A technology risk view EMC can act on each month, independent of the teams that build and run the services, and cover for the CRO

Key accountabilities

1. Own the technology and operational risk framework across platforms, cloud, data centre, SOC and NOC: a risk profile, tolerance and indicators for every critical service.

2. Run the go-live and service-acceptance risk gate with the COO: tested recovery, security testing, data protection assessment and named owners before any launch or takeover.

3. Own the risk profile of each product HT operates (digital banking, Converge, e- invoicing, open banking APIs): payments, fraud and data rules mapped to controls; threat modelling and penetration testing before each release; fraud and dispute indicators monthly; readiness sign-off before each new country.

4. Provide second-line challenge to the CISO, CTIO and Operations on security posture, patching, incident handling and change control.

5. Run quarterly access reviews across HT and client environments; oversee privileged and vendor access; verify joiner, mover and leaver controls and background screening with HR for everyone with client or sensitive access, including contractors.

6. Verify the service figures clients and management receive (availability, SLA attainment, incident response) before release; hold root-cause reviews after every major incident.

7. Build continuous control monitoring in Sentra (MFA, stale accounts, patching, access); report the monthly technology and operational risk view to EMC, feeding the CRO's Board report.

8. Deputise for the CRO at EMC, client forums and the IMS management review.

Experience and qualifications

• 10+ years in technology risk, IT audit or IT risk consulting in a bank, payments company, telco or managed service provider

• CISA or CRISC required; CISM, CFE or ISO/IEC 27001 Lead Auditor an advantage

• Hands-on with cloud (AWS), digital banking or payments platforms, identity and access, and SOC/NOC operations

• Working knowledge of CBN payments and cybersecurity rules and PCI DSS

• Has presented to an executive committee Risks it leads on

Framework categories: Technology, Operational, Emerging, Reputational

• Programme governance, cyber strategy and change management challenge

• Software security, infrastructure security and threat and vulnerability management for flagship products

• Cloud security: provider inventory, controls baseline, compliance

• Identity and access management; workforce screening, phishing and awareness

• Monitoring: logs, SIEM, cyber risk analytics, metrics

• Fraud monitoring and payments-rule compliance on platforms

Measures of success

• Critical services with a current risk profile: 100%

• Launches and takeovers through the gate: 100%

• Reported vs verified service figures: no material gap

• Access reviews on time: 100%; privileged staff with current screening: 100%

• Fraud loss rate and dispute volume: falling

Works with: CTIO, CISO, COO, HR, practice leads, product owners, SOC and platform partners, client risk forums

Grows later with: IT Risk & Controls Analyst (access reviews, screening verification, continuous monitoring); Platform & Fraud Risk Analyst (fraud monitoring, new-country readiness) when platforms expand across borders.