Incident Manager at Paystack

About the Incident Manager role

• You will own how Paystack responds to, communicates about, remediates and learns from every incident, so that merchants, regulators, leadership and our own teams trust us when things go wrong.
• You will own the incident lifecycle across all severities, from intake to closure and retrospective.
• Functional teams fix the underlying cause; you make sure every incident is owned, communicated, quantified, followed through and closed, and that it does not happen twice. Merchant experience is the lens for every decision: how quickly merchants hear from us, how little they are affected, and how quickly their experience is restored.

The scope covers all incidents company-wide, not only engineering:

• Platform and partner incidents: outages, degraded success rates and partner downtime (e.g. NIBSS, card schemes)
• Security and fraud: cyberattacks, card testing and BIN attacks, account compromise
• Operational loss events: financial losses from process gaps (e.g. pricing errors, reconciliation gaps, counterparty exposure)
• Compliance and data protection: regulatory, third-party, privacy and AI-related breaches
• Reputational: negative press or public merchant escalations
• You will work closely with Risk, Engineering, Compliance, Finance, CX and Brand. You will report into Operations.

We’ll trust you to 
Respond:

• Make sure every incident is owned, progresses within SLA and is followed through until affected merchants' experience is restored.
• Incident coordination across all severities: Triage, classify and assign an owner to every incident, with severity driven by merchant impact (e.g. number and tier of merchants affected, payment volume at risk). Lead the response directly for Sev1 and Sev2 (i.e. convene the right people, set the cadence, keep the timeline and decision log); for Sev3 and Sev4, ensure owners progress within SLA.
• SLA enforcement and escalation: Monitor response and resolution times against severity SLAs, enforce escalation triggers (e.g. Sev2 upgrades to Sev1 after 4 hours without response), and escalate unowned or stalled incidents to line managers.
• Own remediation: Drive the follow-through, e.g. merchant and partner follow-ups, working with action owners, coordinating refunds, reversals or fund recovery, and confirming fixes hold and merchant issues are resolved before closure.

Communicate:

• Keep customers and leadership informed with clear, timely and accurate updates, before, during and after an incident.
• Customer communication: Own merchant and customer communication during and after incidents, i.e. tiered merchant comms, status page, CX and GTM briefings, and closure follow-ups. Merchants should hear from us before they have to ask, and no affected merchant is left without an update until the incident is closed. Maintain pre-approved templates and refresh the crisis comms playbooks with Brand.
• Executive communication: Keep the OT and leadership informed at the cadence each severity requires, and prepare incident and loss reporting for the board and its risk committee.
• Regulatory handoff: Flag incidents that may trigger regulatory, scheme or data protection notifications to Risk, who own those notifications, and provide the incident facts and timeline they need.

Learn and improve:

• Turn every incident into fewer, smaller and better-handled incidents over time.
• Retrospectives and root cause resolution: Facilitate blameless retrospectives within 5 business days, classify root causes against the taxonomy, assess merchant impact and how well merchants were kept informed, and track remediation to closure. Spot recurring incidents and trends, and drive fixes to the underlying problem, not only the symptom.
• Loss tracking and risk linkage: Ensure every incident records amount lost, amount recovered and a recovery owner. Work with Risk to quantify losses against risk appetite thresholds and feed control gaps into the risk register.
• Process refinement: Own the incident management playbook and continuously improve it, i.e. severity criteria, SLAs, escalation paths, function-specific report templates and the system of record.
• Detection and reporting: Work with Engineering, Risk and Finance so incidents surface through systems, not self-reporting (e.g. alerts, reconciliation breaks, loss thresholds). Report on incident volume by severity, merchants affected, time to first merchant update, share of incidents raised by merchants before we detected them, time to respond and resolve, losses, repeat incidents and overdue actions, and keep audit-ready records.

Required skills

• 5-7 years of experience in incident management, operations or operational risk.
• A track record running major incidents or crises (e.g. as incident commander, major incident manager or operational risk lead).
• Working knowledge of incident and problem management, blameless retrospectives and operational loss management.
• Strong tooling and data fluency: you work well in Jira or similar and status pages, and pull your own data to track trends and losses.

You’ll thrive in this role if you:

• Put merchants first. You understand how incidents land for a business that depends on getting paid, and you prioritise minimising and resolving merchant impact.
• Stay composed under pressure. You can run a Sev1 response with senior stakeholders and make clear calls on incomplete information.
• Are a clear communicator, verbally and in writing. Your updates to merchants, executives and the board are fast, accurate and calm.
• Influence without authority. You have credibility with Engineering, Risk, Compliance, Finance and CX, and the judgement to push for rigour without blame.
• Are a structured operator who designs processes people follow, uses tooling well and uses data to track losses and trends.
• Close loops. Nothing is closed while an action or a merchant update is outstanding.

Bonus points if you have:

• A background in CX, merchant operations or operational risk
• Experience setting up an incident management function from scratch
• Experience in payments, banking or fintech, or another regulated, always-on business.