Technology, Platforms & Operational Risk Manager at Heirs Holdings

Key accountabilities

• Own the technology and operational risk framework across platforms, cloud, data centre, SOC and NOC: a risk profile, tolerance and indicators for every critical service.
• Run the go-live and service-acceptance risk gate with the COO: tested recovery, security testing, data protection assessment and named owners before any launch or takeover.
• Own the risk profile of each product HT operates (digital banking, Converge, e- invoicing, open banking APIs): payments, fraud and data rules mapped to controls; threat modelling and penetration testing before each release; fraud and dispute indicators monthly; readiness sign-off before each new country.
• Provide second-line challenge to the CISO, CTIO and Operations on security posture, patching, incident handling and change control.
• Run quarterly access reviews across HT and client environments; oversee privileged and vendor access; verify joiner, mover and leaver controls and background screening with HR for everyone with client or sensitive access, including contractors.
• Verify the service figures clients and management receive (availability, SLA attainment, incident response) before release; hold root-cause reviews after every major incident.
• Build continuous control monitoring in Sentra (MFA, stale accounts, patching, access); report the monthly technology and operational risk view to EMC, feeding the CRO's Board report.
• Deputise for the CRO at EMC, client forums and the IMS management review.

Why now

• HT's growth lines are services it operates for others and products it runs for banks and Group companies; one Head of Risk cannot give independent assurance over all of them.
• The Group audit lists IT Risk & Controls as a critical vacancy and key-person risk as HT's top issue.
• External benchmark: Uptime Institute 2025: 54% of significant outages cost over US$100,000; 85% of human-error outages stem from procedures not followed. NIBSS: Nigerian financial institutions lost ₦52.26bn to fraud in 2024, up 196%. Verizon DBIR 2025: credential abuse is the leading breach vector.

Experience and qualifications

• 10+ years in technology risk, IT audit or IT risk consulting in a bank, payments company, telco or managed service provider
• CISA or CRISC required; CISM, CFE or ISO/IEC 27001 Lead Auditor an advantage
• Hands-on with cloud (AWS), digital banking or payments platforms, identity and access, and SOC/NOC operations
• Working knowledge of CBN payments and cybersecurity rules and PCI DSS
• Has presented to an executive committee Risks it leads on
• Framework categories: Technology, Operational, Emerging, Reputational
• Programme governance, cyber strategy and change management challenge
• Software security, infrastructure security and threat and vulnerability management for flagship products
• Cloud security: provider inventory, controls baseline, compliance
• Identity and access management; workforce screening, phishing and awareness
• Monitoring: logs, SIEM, cyber risk analytics, metrics
• Fraud monitoring and payments-rule compliance on platforms