Latest Jobs at Heirs Insurance Ltd

About the Role

We are seeking a proactive and detail-oriented Senior Fraud Analyst to join our team.

• In this role, you will be responsible for detecting, investigating, and responding to fraudulent activity across our digital banking platforms. Working at the intersection of fraud operations, security monitoring, and threat intelligence, you will help protect our customers by identifying emerging fraud patterns, investigating suspicious transactions, and supporting the continuous improvement of fraud prevention controls.

Key Responsibilities

• Monitor fraud alerts and investigate suspicious activities in real time.
• Identify and analyse fraud patterns, including account takeover, SIM-swap attacks, social engineering, device fraud, and transaction manipulation.
• Conduct end-to-end fraud investigations and maintain accurate case documentation.
• Analyse transaction, device, and behavioural data to identify emerging fraud trends.
• Collaborate with Customer Service, Operations, Legal, Risk, and Technology teams to resolve fraud incidents.
• Develop, test, and optimise fraud detection rules to improve detection accuracy while reducing false positives.
• Support fraud incident response activities and recommend improvements to fraud controls.
• Prepare fraud reports and provide insights into emerging threats and trends.
• Ensure compliance with applicable regulatory reporting requirements.

Requirements

Experience

• Minimum of 3 years' experience in fraud analysis, fraud operations, or financial crime investigation.
• At least 2 years' experience in mobile banking, digital payments, or financial services fraud.
• Strong understanding of fraud typologies, including:
• Account Takeover (ATO)
• SIM-swap fraud
• Social engineering
• Device cloning
• Credential stuffing
• Authorised Push Payment (APP) fraud
• Experience using fraud monitoring platforms and investigating fraud alerts.
• Strong analytical skills with experience using SQL, Excel, or similar tools to analyse transaction and behavioural data.
• Experience documenting fraud investigations and preparing investigation reports.

Preferred Qualifications

• Bachelor's degree in a relevant discipline.
• Professional certifications such as Certified Fraud Examiner (CFE), CAMS, or equivalent are an advantage.
• Experience with behavioural biometrics or device intelligence platforms (e.g., BioCatch, ThreatMetrix).
• Knowledge of fraud trends within African digital banking and payment ecosystems.

What We're Looking For

We're looking for someone who:

• Has exceptional analytical and problem-solving skills.
• Can recognise fraud patterns quickly and respond effectively.
• Works well under pressure while maintaining attention to detail.
• Demonstrates strong investigative and critical-thinking abilities.
• Communicates effectively and collaborates across multiple teams.
• Is passionate about staying ahead of emerging fraud threats.

go to method of application »

About the Role

• We are looking for an experienced Senior Penetration Tester to lead offensive security testing across our cloud-hosted digital banking platform. In this role, you will identify, validate, and exploit security vulnerabilities across cloud infrastructure, Kubernetes environments, backend services, APIs, CI/CD pipelines, and banking integrations.
• Working closely with the Cyber Security leadership team, you will provide technical expertise that strengthens our security posture, influences remediation priorities, and helps ensure our platforms meet the highest security standards.

Key Responsibilities

• Plan and execute penetration tests across cloud infrastructure, networks, and backend systems.
• Assess the security of AWS cloud environments, Kubernetes clusters, IAM configurations, VPNs, firewalls, and network segmentation.
• Perform API security testing, including authentication, authorization, encryption, and injection testing.
• Evaluate CI/CD pipelines, container security, infrastructure-as-code, and software supply chain controls.
• Conduct database and infrastructure security assessments.
• Perform assumed-breach and lateral movement exercises.
• Produce detailed penetration testing reports with risk ratings, proof-of-concept evidence, and remediation recommendations.
• Present findings to technical and executive stakeholders.
• Validate remediation efforts through retesting.

Required Qualifications

Experience

• Minimum 5 years of hands-on penetration testing experience.
• At least 3 years focused on:
• AWS cloud security
• Kubernetes security
• CI/CD pipeline security
• Infrastructure penetration testing

Technical Skills

Strong experience with:

• AWS Security Services
• Kubernetes Security
• API Security Testing
• Network Security
• VPN Security
• Container Security
• Infrastructure-as-Code security
• OWASP Testing Methodologies

Experience using tools such as:

• Burp Suite Professional
• Nmap
• Metasploit
• Nuclei
• kubectl
• AWS CLI
• Checkov
• Trivy
• Python or Go scripting

Certifications

Required

• Offensive Security Certified Professional (OSCP)

Highly Preferred

• Offensive Security Experienced Penetration Tester (OSEP)
• AWS Certified Security – Specialty
• Certified Kubernetes Security Specialist (CKS)
• Certified Kubernetes Application Developer (CKAD)
• GIAC Penetration Tester (GPEN)

Preferred Experience

• Financial Services, Banking, or FinTech environments
• PCI-DSS and ISO 27001
• Payment platform security
• Cloud WAF security
• Runtime security tools (Falco, Tetragon, Groundcover)
• Red Team engagements
• Multi-cloud environments

What We're Looking For

We're looking for someone who:

• Demonstrates deep technical expertise in offensive security.
• Can identify complex vulnerabilities beyond automated scanning.
• Produces high-quality technical reports for both technical and executive audiences.
• Exercises sound judgment when handling critical security findings.
• Maintains the highest standards of professionalism and integrity.
• Stays current with emerging attack techniques and threat intelligence.

go to method of application »

The Role

• As a Senior Database Engineer, you will design, build, and operate the data infrastructure that sits at the heart of this platform. You will own both the relational and distributed NoSQL database layers, ensuring they are highly available, performant, secure, and built to scale to hundreds of millions of users without architectural rework. On a financial platform where data integrity, availability, and compliance are non-negotiable, the database layer is one of the most critical surfaces on the platform, and you own it.

What You'll Do

• Database Engineering & Design: Own the design, provisioning, and ongoing engineering of the platform's database infrastructure across both relational and distributed NoSQL layers, spanning PostgreSQL and Apache Cassandra deployments on AWS and Azure. Translate platform data requirements into robust, scalable, and well-structured data models that support high-throughput transactional workloads, event-driven patterns, and long-term data growth without requiring fundamental rework.
• Relational Database Engineering: Own the platform's PostgreSQL deployments across Azure Database for PostgreSQL and Amazon RDS/Aurora, including schema design, indexing strategies, query optimisation, table partitioning, and replication configuration. Ensure every relational data model is clean, normalised where appropriate, and designed to perform under the load of millions of concurrent users.
• Distributed & NoSQL Engineering: Own the platform's Apache Cassandra deployments across Azure Managed Instance for Apache Cassandra and Amazon Keyspaces, including data modelling, partition key design, consistency level configuration, compaction strategy tuning, and cluster management. Design for write-heavy, high-throughput workloads and ensure partition strategies are fit for the platform's access patterns at scale.
• High Availability & Disaster Recovery: Design and maintain highly available database configurations across both clouds, including replication, automated failover, cross-region redundancy, and backup and recovery pipelines. Define and enforce RTO and RPO targets for all database services. Ensure that no single database failure can cause data loss or platform downtime, and that recovery from any failure is fast, tested, and well-documented.
• Cross-Cloud Data Replication & Active-Active Architecture: Design, implement, and continuously validate real-time data replication between the platform's AWS and Azure database environments, across both PostgreSQL and Apache Cassandra, targeting an active-active configuration where both clouds can serve live traffic simultaneously. Where active-active introduces unacceptable complexity, ensure active-passive replication is consistent enough that failover to the standby cloud is seamless, with near-zero data loss and near-zero transaction gap. Own the replication testing programme, including regular automated failover drills, so that cross-cloud recovery is proven, not assumed, at all times.
• Performance Engineering: Own database performance end- to- end, from schema design to query execution. Conduct regular slow query analysis, execution plan reviews, and index audits. Tune connection pooling, caching configurations, and database parameters to sustain platform performance as user load grows. Proactively identify and resolve performance bottlenecks before they reach production.
• Database Security & Compliance: Enforce database security standards across all environments, including AES-256 encryption at rest, TLS 1.2+ in transit, IAM-based access controls, least-privilege database user permissions, and audit logging for all privileged access and data modifications. Ensure all database configurations meet PCI DSS and CBN compliance requirements. No database credential is ever hardcoded or stored outside an approved secrets management platform.
• Database as Code: Provision and manage all database infrastructure, including instances, configurations, replication settings, and network connectivity, through version-controlled Infrastructure as Code using Terraform, Ansible, and Bash. No database environment may be provisioned or modified manually. All database configurations must be reproducible, auditable, and deployable on demand through automated pipelines.
• Migration & Schema Change Management: Design and execute zero-downtime database migrations and backwards-compatible schema changes, ensuring no migration ever causes a production outage or data inconsistency. Own the migration tooling and process, integrate schema change workflows into CI/CD pipelines, and ensure every migration is tested, reversible, and reviewed before it reaches production.
• Observability & Monitoring: Instrument all database layers with the metrics, alerting, and logging needed to provide complete visibility into database health, performance, and access patterns at all times. Ensure database telemetry feeds into the platform's centralised observability stack, with alerting tuned for replication lag, slow queries, connection exhaustion, lock contention, and unexpected access patterns.
• Developer Enablement: Partner with application engineering teams to establish and enforce data modelling standards, query design guidelines, ORM best practices, and migration conventions across the platform. Review data model proposals from product and engineering teams and provide expert guidance that keeps the database layer clean, performant, and consistent as the platform evolves.

What We're Looking For

Must Have

• 5+ years of hands-on database engineering experience in a production, cloud-native environment, with a track record of owning database infrastructure at scale.
• Expert-level PostgreSQL experience, schema design, advanced indexing, query optimisation, table partitioning, replication, and performance tuning under high-concurrency workloads.
• Strong Apache Cassandra experience, data modelling, partition key design, consistency level configuration, compaction tuning, and cluster operations.
• Hands-on experience with cloud-managed database services, Azure Database for PostgreSQL, Amazon RDS/Aurora, Azure Managed Instance for Apache Cassandra, and/or Amazon Keyspaces.
• Solid understanding of database security, encryption at rest and in transit, IAM-based access controls, audit logging, and compliance requirements in regulated environments.
• Experience provisioning and managing database infrastructure as code, Terraform, Ansible, and Bash, with a clear understanding that no database environment is ever provisioned manually.
• Proven experience designing and executing zero-downtime database migrations and backward-compatible schema changes in live production environments.

Nice to Have

• Experience with Redis for caching, configuration, eviction policies, cluster mode, and integration with application services.
• Familiarity with event-driven architecture patterns, including event sourcing, CQRS, and the data modelling considerations they introduce.
• Experience in fintech, banking, or a regulated data environment, with working knowledge of PCI DSS data requirements or CBN guidelines.
• AWS and/or Microsoft Azure database certifications.
• Experience with database observability tooling, slow query analysis, execution plan visualisation, and replication monitoring at scale.
• Familiarity with data residency and cross-border data transfer requirements across African markets.

go to method of application »

The Role

• The Platform Manager (Security) is the dedicated security authority for the platform, not a generic security function but an embedded owner living inside the software factory. Reporting to the Cybersecurity Director and working hand-in-hand with the Platform Manager, you sit at the intersection of platform engineering, DevSecOps, cybersecurity, legal, and vendor management. You own the definition, implementation, and strict enforcement of the platform's security posture across every team, system, and workstream. On a platform handling the financial data of millions of Africans, the goal isn't to make compromise impossible; it's to ensure any attempt is hard, incomplete, noisy, traceable, attributable, and commercially useless without the platform's infrastructure, credentials, pipelines, and integrations.

What You'll Do

• Security Standards & Governance: Define, enforce, and continuously improve end-to-end security standards, policies, and controls covering encryption, identity, application security, network security, data protection, and compliance across every team and contributor.
• Identity & Access Management: Own the platform's IAM framework, MFA for all human access, service-to-service authentication via short-lived tokens and managed identities, privileged access management, just-in-time elevation, session recording, and automatic expiry. Standing privileged access to production is prohibited without formal exception.
• Source Code & Repository Integrity: Own security of the source-control environment end-to-end, repository segmentation by domain/team/access need, SSO and MFA across all contributors, branch protection with mandatory pull requests, CODEOWNERS approval and peer review, no direct commits or force-pushes to protected branches, secret scanning and push protection, and audit logs exported to SIEM. Access maps strictly to role and deliverable and is reviewed regularly.
• Application Security: Own the secure development lifecycle, ensuring security is designed in, not retrofitted. Govern SAST, DAST, SCA, and secrets detection gates across all CI/CD pipelines. No service reaches production without passing every gate.
• Encryption & Data Protection: Enforce AES-256 at rest and TLS 1.2+ in transit. Own key management through Azure Key Vault and AWS KMS, including rotation and access controls. Drive data classification, DLP enforcement, and protection of customer, payment, and authentication data.
• Penetration Testing & Vulnerability Management: Commission penetration testing before every launch and on a regular cadence. Own vulnerability management, ensuring critical and high CVEs are tracked and remediated on agreed timelines. Critical findings must be resolved before go-live.
• Regulatory Compliance: Own compliance posture across CBN guidelines, PCI DSS, and applicable data protection regulations in all operating markets, including data residency and cross-border transfer requirements.
• Incident Response & Unified Monitoring: Own the Incident Response Plan (detection through post-incident review), escalating critical incidents within prescribed timelines. Maintain unified monitoring correlating repository logs, endpoint DLP telemetry, identity/VPN logs, and CI/CD activity, feeding SIEM for continuous alerting. All production systems monitored 24/7 with alerts routed to an active SOC.
• Supply Chain & Container Security: Enforce container image scanning (Trivy), runtime threat detection (Falco), and dependency scanning (Snyk) in every pipeline. No container deploys without passing security gates.
• Insider Threat, Endpoint & Workforce Risk: Define workstation security requirements (EDR, disk encryption, patching, compliance). Evaluate VDI/cloud-hosted dev environments with download/clipboard/USB controls for high-risk contributors. Implement insider-risk monitoring for abnormal behaviour (mass downloads, unusual clone volume, privilege escalation, post-termination access attempts), privacy-aware and integrated with SIEM/SOC.
• Partner, IP & Third-Party Controls: Own security due diligence for partners and contractors, contractual IP/confidentiality/data protection/audit clauses, least-privilege time-bound access reviewed regularly and revoked on exit. Enforce structured offboarding and coordinate with Legal/HR on suspected IP infringement.
• Security Architecture Collaboration: Partner with the Enterprise Architect, Platform Manager, and engineering leads so security is designed in from day one for every new service, feature, and integration.
• Executive Reporting: Report regularly to the Cybersecurity Director on security posture, compliance, incidents, and risk. Represent the security function at leadership and board level as required.

What We're Looking For

Must Have

• 8+ years in information security or cybersecurity, with proven ownership of a security function in a large-scale, cloud-native, or financial services environment
• Deep expertise across the full security stack: IAM, encryption/key management, application security (SDLC, SAST, DAST, SCA), network security, DLP, and incident response
• Strong hands-on cloud security knowledge on AWS and/or Azure, including native security services, IAM, private networking, zero-trust architecture, and cloud-native threat detection
• Demonstrated experience owning regulatory compliance in financial services (PCI DSS, CBN guidelines, or equivalent)
• Experience designing and operating a SOC function, including 24/7 monitoring, SIEM integration, alert management, and incident escalation
• Active CISSP or CISM certification required

Nice to Have

• CSSLP and/or CCSP certification
• AWS Certified Security, Specialty and/or Microsoft SC-200 or SC-100
• Hands-on experience with container and supply chain security tooling (Trivy, Falco, Snyk)
• Familiarity with IaC security scanning (Terraform, Ansible, Bash) for misconfigurations, hardcoded secrets, and insecure defaults
• Experience implementing insider threat monitoring in regulated financial services
• Familiarity with African regulatory frameworks: CBN guidelines, NDPR, and data residency requirements

go to method of application »

The Role

• As a Senior DevSecOps Engineer, you are the builder and operator of the pipelines, tooling, and security controls that let every engineer on this platform ship fast and ship safely. You will design, implement, and own the CI/CD infrastructure, security gates, container build pipelines, and developer tooling that govern how code moves from a developer's workstation to production. On a platform handling the financial data of millions of Africans, the pipeline is a critical control surface, and you own it end to end.

What You'll Do

• Ci/CD Pipeline Design & Ownership: Own the design, implementation, and ongoing operation of the platform's CI/CD infrastructure, ensuring every service, across every team, ships exclusively through automated, version-controlled pipelines. Build and maintain pipelines across the platform's approved CI/CD tooling, GitHub Actions, Azure DevOps Pipelines, GitLab CI, and Jenkins. No engineer has direct access to promote code to any environment manually. Every pipeline must be reproducible, auditable, and fast.
• Pipeline Quality Gates: Embed security, quality, and performance validation into every stage of the development lifecycle, enforcing mandatory, automated gates on the path to production. Implement and operate SAST, DAST, SCA, and secrets detection for security; automated test coverage thresholds, integration tests, and end-to-end test suites for quality; and load testing and performance benchmark gates to ensure no release degrades platform performance. Integrate AI-powered code review and testing agents into CI/CD pipelines, automating test generation, surfacing code quality issues early, and augmenting human review before code reaches a reviewer. No service may be promoted to staging or production without passing every gate. Work closely with the Platform Manager (Security) to define gate policies, manage exceptions, and continuously raise the bar.
• Container Build & Supply Chain Security: Own the platform's container build pipeline end to end, from base image governance to final image publication. Enforce the use of approved, minimal base images. Integrate container image scanning (Trivy) and dependency vulnerability scanning (Snyk) into every build. No container image reaches any environment without passing security scans. Maintain a software bill of materials (SBOM) for all platform services and ensure supply chain integrity is continuously monitored.
• Infrastructure as Code Pipeline Integration: Integrate all infrastructure provisioning workflows, Terraform, Ansible, and Bash, into version-controlled, automated pipelines. Enforce IaC security scanning and policy checks before any infrastructure change is applied. No cloud or network configuration may be provisioned outside of a pipeline-controlled workflow. Work with Cloud and Network Engineers to ensure infrastructure pipelines meet the same security and auditability standards as application pipelines.
• Environment Management & Dev Containers: Own the platform's environment strategy, ensuring dev, staging, and production are consistently defined, reproducible, and spun up on demand via IaC. Enforce the use of dev containers across all engineering teams, every developer works in a standardised, version-controlled development environment that mirrors production. No environment drift. No snowflake configurations.
• Secrets Management Integration: Integrate Azure Key Vault and AWS Secrets Manager, or equivalent secrets management platforms, into all CI/CD pipelines and application deployment workflows. Enforce secret rotation schedules. Ensure no secret, credential, API key, or certificate is ever hardcoded in application code, configuration files, container images, or pipeline definitions. Any violation must trigger an automated alert and mandatory rotation.
• Observability & DORA Metrics: Instrument all CI/CD pipelines with the metrics and tooling needed to track, baseline, and continuously improve the platform's engineering performance. Own the collection and reporting of DORA metrics, deployment frequency, lead time for changes, change failure rate, and mean time to recovery (MTTR). Surface these metrics to the Platform Manager in real time and use them to drive targeted pipeline improvements.
• Developer Experience & Standards: Make the right way the easy way. Own the developer tooling, onboarding documentation, and pipeline standards that define how engineers contribute to this platform. Reduce friction on the path to production without compromising security or quality. Work alongside the DevSecOps Evangelist to educate and embed DevSecOps best practices across engineering teams, supporting enablement sessions, flagging anti-patterns early, and ensuring every contributor understands and actively applies the platform's standards.
• Runtime Security: Implement and operate runtime security controls across the platform's containerised workloads, including Falco for runtime threat detection and container security policy enforcement. Ensure anomalous container behaviour triggers automated alerts routed to the SOC and Platform Manager (Security). Work with the security team to continuously tune detection rules and close runtime security gaps.
• Incident & Rollback Support: Maintain robust, tested rollback and re-deployment capabilities across all services and environments. Act as a key technical resource during platform incidents, diagnosing pipeline and deployment-layer failures, executing rollbacks, and restoring stability. Ensure all pipeline runbooks are documented, version-controlled, and regularly tested so that recovery from any deployment failure is fast, reliable, and well-practised.

What We're Looking For

Must Have

• 4+ years of hands-on DevSecOps or DevOps engineering experience, with proven ownership of CI/CD pipelines in a production, cloud-native environment.
• Expert-level experience with one or more of the platform's approved CI/CD tools, GitHub Actions, Azure DevOps Pipelines, GitLab CI, or Jenkins, and the ability to design, debug, and optimise complex pipeline workflows.
• Hands-on experience integrating security tooling into CI/CD pipelines, including SAST, DAST, SCA, and secrets detection. You understand what each gate is checking and why it matters.
• Strong container security knowledge, Docker image builds, base image governance, image scanning with Trivy or equivalent, and supply chain security with Snyk or equivalent.
• Solid Infrastructure as Code experience, Terraform, Ansible, and Bash, with a clear understanding that all infrastructure must be provisioned through automated, version-controlled pipelines, never manually.
• Hands-on experience with container orchestration platforms, Kubernetes on managed services (AKS, EKS) or serverless container platforms (Azure Container Apps, AWS App Runner / ECS Fargate).
• Working knowledge of secrets management platforms, Azure Key Vault, AWS Secrets Manager, or equivalent, and experience integrating them into CI/CD workflows.

Nice to Have

• Experience with runtime security tooling, specifically Falco for container threat detection.
• Familiarity with DORA metrics tooling and experience using engineering performance data to drive pipeline improvement.
• Experience with serverless compute platforms, Azure Functions and/or AWS Lambda, for event-driven pipeline triggers or lightweight automation.
• AWS and/or Microsoft Azure certification, Developer, DevOps, or Solutions Architect tracks.
• Experience working in a fintech, banking, or regulated environment, with working knowledge of PCI DSS pipeline security requirements or CBN guidelines.
• Familiarity with software bill of materials (SBOM) tooling and supply chain security frameworks (e.g., SLSA, NIST SSDF).

go to method of application »

The Role

• As a Senior Cloud Engineer, you will be a hands-on builder of the cloud infrastructure that powers Africa's most ambitious digital banking platform. You will design, provision, and operate a dual-cloud environment across AWS and Azure, ensuring it is always on, highly secure, infinitely scalable, and built entirely in code. You will work closely with architects, DevSecOps engineers, and application teams to deliver infrastructure that meets the highest standards of performance, resilience, and security.

What You'll Do

• Dual-Cloud Infrastructure: Design, provision, and maintain production-grade cloud infrastructure across both AWS and Azure, ensuring both environments mirror each other in architecture, connect reliably to the institution's on-premises Core Banking systems, and operate with no single point of vendor dependency.
• Infrastructure as Code: Define every environment, dev, staging, and production, in version-controlled IaC. Terraform, Ansible, and Bash are the approved tools for infrastructure provisioning and automation. No manual cloud provisioning. All environments must be reproducible, auditable, and spun up on demand.
• High Availability & Resilience: Architect and maintain highly available configurations across all services, databases, middleware, and storage, targeting 99.99% platform uptime. Implement circuit breakers, retry logic, auto-scaling, and graceful fallbacks so users never feel a backend failure.
• Private Networking & Zero Trust: Own the platform's private network architecture, ensuring every cloud environment is isolated, segmented, and built on the principle that no internal service is ever publicly reachable. Design and maintain the full private networking stack across AWS and Azure: VNets, dedicated subnets, NSGs, private DNS, and private endpoints for all managed services. Enforce zero-trust principles across all internal communication, no implicit trust, every request authenticated and authorised. Public internet exposure is limited strictly to approved entry points: Cloudflare DDoS, then WAF, then API Gateway.
• Auto-Scaling & Cost Efficiency: Own the platform's approach to scalability and cloud cost efficiency, ensuring infrastructure responds dynamically to demand and never carries unnecessary cost. Configure services to scale to zero at idle and scale out at peak without manual intervention. Continuously monitor and optimise cloud resource consumption, ensuring no environment is over-provisioned and every element of platform spend is lean and justified.
• Managed Services & Platform Stack: Provision and operate the platform's managed cloud services, including PostgreSQL (Azure Database for PostgreSQL, Amazon RDS/Aurora), Apache Cassandra (Azure Managed Instance, Amazon Keyspaces), Redis, RabbitMQ/Azure Service Bus/Amazon SQS, and Kong API Gateway.
• Secrets & Key Management: Manage all secrets, certificates, and encryption keys through Azure Key Vault, AWS Secrets Manager, or equivalent secrets management platform. Enforce rotation schedules. Ensure no credential is ever hardcoded in application code, configuration files, or container images.
• Security & Compliance: Implement and maintain cloud security controls, including AES-256 encryption at rest, TLS 1.2+ in transit, DLP monitoring for abnormal data transfer and unauthorised export, and alerting on policy changes or attempts to disable logging. Contribute to PCI DSS and CBN compliance posture.
• Observability: Instrument cloud infrastructure with centralised logging, metrics, and alerting from day one. Ensure every layer of the infrastructure stack is fully visible, no blind spots in production.
• CI/CD Integration: Integrate cloud infrastructure provisioning into DevSecOps pipelines, ensuring infrastructure changes flow through the same automated, security-gated pipelines as application code.

What We're Looking For

Must Have

• 5+ years of hands-on cloud engineering experience at scale, with production deployments on both AWS and Azure, including compute, networking, storage, managed databases, and messaging services.
• Expert-level Infrastructure as Code skills, Terraform, Ansible, and Bash, with a strong understanding of state management, module design, and CI/CD-integrated provisioning workflows.
• Deep experience designing and operating private, secure cloud network architectures, VNets, NSGs, private endpoints, private DNS, VPNs, and zero-trust network segmentation.
• Strong understanding of cloud security fundamentals, encryption (AES-256, TLS 1.2+), key management (Azure Key Vault, AWS KMS), identity and access management, and least-privilege access controls.
• Hands-on experience with containerised workloads, Docker, Kubernetes or equivalent orchestration platforms on managed cloud services (AKS, EKS), and serverless container platforms including Azure Container Apps and AWS App Runner / ECS Fargate.
• Working knowledge of high-availability patterns, multi-region deployments, auto-scaling, load balancing, circuit breakers, and disaster recovery design.
• AWS Certified Solutions Architect, Professional (SAP-C02), required.

Nice to Have

• Microsoft Certified: Azure Solutions Architect Expert (AZ-305), strongly preferred as the platform expands to dual-cloud.
• Experience with serverless compute platforms, Azure Functions and/or AWS Lambda, for event-driven, lightweight processing workloads.
• Experience with the platform's managed services stack: Azure Database for PostgreSQL, Amazon RDS/Aurora, Azure Managed Instance for Apache Cassandra, Amazon Keyspaces, Azure Service Bus, Amazon SQS, or Redis.
• Familiarity with Cloudflare (DDoS protection, WAF) and API gateway configuration (Kong or equivalent).
• Experience in fintech, banking, or regulated cloud environments, with working knowledge of PCI DSS, CBN guidelines, or equivalent data residency and compliance requirements.
• Cloud cost management experience using FinOps tooling or native cloud cost monitoring and optimisation features.

go to method of application »

The Role

• As Senior Programme Manager, you will be the primary execution partner to the Programme Director, the person who keeps every workstream moving, every dependency tracked, every risk visible, and every decision followed through. You will directly lead Scrum Masters and Project Managers across the programme, establishing the delivery standards, governance discipline, and coordination rhythm that a platform of this scale and complexity demands.
• This is not a traditional project administration role. It requires a senior programme leader who has delivered large-scale digital banking or software platform programmes, understands agile engineering delivery from the inside, can operate confidently at executive level, and brings the urgency, structure, and ownership mindset to keep a complex, multi-jurisdiction programme on track.

What You'll Do

• Programme Leadership & Delivery Control: Support the Programme Director in leading end-to-end execution across all workstreams. Maintain an integrated view of scope, timelines, milestones, risks, dependencies, decisions, and delivery commitments. Drive execution discipline, ensuring every workstream has clear owners, actions, and dates. Provide leadership continuity and structured follow-through when the Programme Director is focused on executive, strategic, or external stakeholder matters.
• Multi-Workstream Coordination: Coordinate delivery across all major programme workstreams: product management and customer journeys; UI/UX and frontend delivery; backend engineering; API and core banking integration; cloud platform and DevSecOps; cybersecurity, fraud controls, and regulatory readiness; data and analytics; legal, IP, and contracting; budget and procurement; people and onboarding; go-to-market and launch readiness; and multi-country rollout planning.
• Team Leadership & Delivery Management: Lead and performance-manage Scrum Masters and Project Managers across the programme. Establish consistent delivery, agile, and reporting standards. Ensure effective sprint planning, dependency management, milestone tracking, and issue resolution. Coach delivery leads in managing risks, stakeholder expectations, and execution challenges.
• Digital Banking & Product Delivery: Translate product priorities into executable delivery plans across design, engineering, integration, testing, and release. Support backlog governance, MVP scope control, and dependency management. Work closely with product owners, architects, engineering leads, UI/UX teams, and business stakeholders to convert approved journeys into working software.
• Software Build Programme Governance: Lead delivery governance for a build-oriented software programme, not a vendor implementation. Track progress across frontend, backend, API, cloud, cybersecurity, and integration teams. Ensure engineering commitments are properly sequenced and dependencies actively managed.
• Risk, Issue & Dependency Management: Own the integrated RAID discipline across the programme. Identify emerging risks early and escalate with clear mitigation options. Track critical dependencies across technology teams, partners, vendors, cloud, cybersecurity, legal, finance, and country stakeholders.
• Governance, Reporting & Stakeholder Management: Prepare high-quality updates for the Programme Director, Executive SteerCo, Technical Committee, Product Council, and other governance forums. Ensure reporting is accurate, concise, and decision-oriented. Maintain programme dashboards, decision logs, dependency trackers, milestone reports, and delivery health views.
• Vendor, Partner & Commercial Delivery: Coordinate delivery dependencies across key partners and accelerators. Track vendor obligations, deliverables, timelines, commercials, legal dependencies, and performance. Ensure partners accelerate delivery without creating long-term ownership, IP, operational, or exit-risk issues.
• Go-to-Market & Launch Readiness: Support the integrated launch plan covering staff pilot, customer pilot, branch enablement, contact centre readiness, training, communication, app store readiness, production cutover, hypercare, and incident response. Ensure go-to-market activities are connected to product readiness, operational readiness, and country rollout sequencing.
• Multi-Jurisdiction & Country Rollout: Support planning across a multi-country operating environment. Track country-specific requirements across regulation, language, payments, integrations, support, customer communication, and operational readiness. Ensure the platform build considers scale, localisation, resilience, and supportability across multiple jurisdictions.

What We're Looking For

Must Have

• Significant experience managing large-scale technology, software development, or digital transformation programmes, with a track record of delivering on time in complex, multi-stakeholder environments.
• Proven delivery experience in digital banking, mobile banking, fintech, payments, or enterprise financial services platforms, with a deep understanding of the product, engineering, and regulatory complexity involved.
• Experience leading teams of Project Managers, Scrum Masters, or delivery leads within a complex programme, with demonstrated ability to set standards, manage performance, and build delivery capability.
• Strong understanding of agile delivery, DevSecOps, sprint planning, release management, backlog governance, testing, and production readiness, with enough technical fluency to engage credibly with engineering leads.
• Demonstrated ability to manage risk, issues, dependencies, governance, and executive reporting in a high-pressure environment, with a clear escalation mindset and strong bias for resolution.
• Experience managing complex build programmes involving product, engineering, cloud, integration, cybersecurity, and go-to-market workstreams simultaneously.
• Confident executive presence, able to prepare and present programme status at SteerCo and board level, and translate complex delivery realities into clear, decision-ready narratives.

Nice to Have

• Experience delivering programmes across multiple countries or regulatory jurisdictions, with working knowledge of how localisation, regulatory variance, and country-specific integration requirements affect delivery planning.
• Experience managing delivery across multiple vendors, system integrators, and technology partners, including tracking commercial obligations, deliverable quality, and exit risks.
• Familiarity with CBN guidelines, PCI DSS, and data protection regulations applicable to financial services in African markets.
• Prior experience as a Senior Programme Manager, Transformation Lead, Delivery Director, or PMO Lead on a major strategic technology programm

go to method of application »

About the Role

• We are seeking an experienced Security Architect / Engineer to lead the security architecture of our mobile banking platform. This role is responsible for designing, governing, and validating security controls across cloud infrastructure, mobile applications, APIs, Kubernetes, DevSecOps pipelines, and banking integrations.
• Working closely with engineering teams and Cyber Security leadership, you will ensure that security requirements are translated into robust, scalable, and compliant technical solutions. You will serve as the technical authority for security architecture and play a key role in protecting a modern cloud-native banking platform.

Key Responsibilities

Security Architecture

• Design and maintain the end-to-end security architecture for the mobile banking platform.
• Review and approve security architecture for new systems, integrations, and infrastructure changes.
• Lead threat modelling exercises for new products and platform enhancements.
• Ensure security architecture aligns with industry best practices and secure design principles.

Cloud & Platform Security

• Design and govern cloud security controls across AWS environments.
• Architect secure Kubernetes and container security solutions.
• Design key management, encryption, PKI, mTLS, JWT, and API security architectures.
• Develop secure CI/CD and DevSecOps security pipelines.

Security Governance

• Lead security acceptance reviews for new technologies and platform migrations.
• Provide technical guidance during penetration testing and remediation activities.
• Support fraud prevention architecture and security monitoring initiatives.
• Maintain security architecture documentation for audit and regulatory compliance.

Stakeholder Engagement

• Present security architecture to technical teams, executive leadership, auditors, and regulators.
• Participate in vendor security assessments.
• Mentor engineers on secure architecture and secure engineering practices.

go to method of application »

The Role

• As Senior Network & Security Engineer, you will design, build, and operate the network and security architecture that keeps this platform private, resilient, and impenetrable. You will own the platform's private cloud networking, zero-trust enforcement, perimeter security controls, and network-level threat monitoring, working closely with the Platform Manager and Platform Manager (Security) to ensure every layer of the network is hardened, observable, and compliant. On a banking platform built for continental scale, the network is the first line of defence, and you own it.

What You'll Do

• Network Architecture: Design and own the platform's end-to-end network architecture, defining topology, segmentation, and connectivity across AWS, Azure, and on-premises environments. Plan a scalable IP addressing strategy with non-overlapping CIDR blocks and dedicated subnets for containers, servers, storage, and management. Front and backend assets must be cleanly separated; no internal service is ever publicly addressable. All decisions must be documented and reflected in version-controlled infrastructure code.
• Network Engineering: Own hands-on engineering of network infrastructure across cloud and on-premises environments, including routing, switching, firewall policy management, VPN setup, and on-premises edge devices (FortiGate, Cisco Nexus 9000). All infrastructure must be written as peer-reviewed code (Terraform, Ansible, Bash), version-controlled, with network security checks integrated into CI/CD. No manual changes to any environment are permitted.
• Zero Trust Enforcement: Implement zero-trust principles platform-wide, no implicit trust anywhere. Every request must be authenticated, authorised, and logged; every network path explicitly permitted, everything else denied by default. Continuously identify and close trust gaps.
• Perimeter & Firewall Security: Own the platform's security boundaries end to end. Externally, the only permitted internet entry point is Cloudflare DDoS protection, WAF, then API Gateway, with rules and configurations tested and enforced as code. Internally, own all firewall and NSG rules across cloud and on-premises environments, defined exclusively via IaC, version-controlled, and regularly reviewed for least-privilege access. No manual firewall or NSG changes are permitted.
• Cloud Network Security & Encryption: Configure and maintain cloud-native network security controls across AWS and Azure, including Security Groups, Network ACLs, AWS Network Firewall, and Azure Firewall. Ensure no storage, database, or service is ever inadvertently exposed to the internet. Enforce TLS 1.2+ everywhere (TLS 1.0/1.1 prohibited) and own the full certificate lifecycle.
• Hybrid & Site-to-Site Connectivity: Design and maintain highly available, redundant connectivity between cloud and on-premises data centres using AWS Direct Connect, Azure ExpressRoute, and IPSec VPN Gateways. Ensure tested failover paths so no single link interrupts core banking connectivity. All links must be encrypted, monitored, and governed as code.
• VPN & Admin Access Controls: Design and operate the platform's JumpNet and VPN infrastructure, the only permitted route for admin access to production, with no exceptions. Enforce MFA on all VPN access and log/monitor all privileged sessions.
• Global Traffic Management: Design and operate global traffic management ensuring user traffic is intelligently distributed across AWS and Azure based on latency, availability, and health, using Route 53/Global Accelerator and Azure Traffic Manager/Front Door with automatic failover. No single cloud environment should be a point of failure.
• Threat Detection & Network Monitoring: Design and operate centralised network monitoring and threat detection, providing real-time visibility into device health, link utilisation, traffic flows, and anomalies. Implement IDS/IPS, anomaly detection, and traffic analysis tooling, feeding all telemetry into the SIEM with alerting tuned for lateral movement, port scanning, unauthorised connections, and control-bypass attempts. No network event goes undetected or unacted upon.
• Incident Response: Act as first responder for network-level security incidents, including containment, isolation, forensic evidence preservation, and root cause analysis. Contribute to the Incident Response Plan and keep network runbooks documented and tested.
• Documentation & Asset Management: Maintain accurate, up-to-date network documentation and a version-controlled inventory of core network assets, including device configs, IP allocations, CIDR assignments, VLAN maps, and topology diagrams, always audit-ready.

What We're Looking For

Must Have

• 5+ years of hands-on network and security engineering experience in a cloud-native production environment, with demonstrated ownership of private network architecture, zero-trust implementation, and perimeter security at scale
• Expert-level knowledge of cloud networking on AWS and/or Azure: VNets, subnets, NSGs, Security Groups, Network ACLs, private endpoints, private DNS, VPN Gateways, and Transit Gateways
• Hands-on experience with perimeter security tooling: Cloudflare (DDoS, WAF), API Gateway configuration (Kong or equivalent), and WAF rule management
• Strong working knowledge of zero-trust architecture: identity-aware proxies, microsegmentation, least-privilege network access, and continuous verification
• Proven experience with network threat detection and monitoring: IDS/IPS, SIEM integration, anomaly detection, and network forensics
• Expert-level knowledge of routing and switching protocols (BGP, OSPF, EIGRP, spanning tree, VLAN trunking) and firewall/security concepts at depth, non-negotiable given the platform's hybrid connectivity and on-premises edge requirements
• Hands-on experience configuring enterprise firewall and core switching platforms, specifically Fortinet FortiGate and Cisco Nexus 9000 series, which run the on-premises core network
• Solid Infrastructure as Code skills (Terraform, Ansible, Bash), with all network security controls version-controlled and never manually provisioned
• Active CCNP Security or CCNP Enterprise certification, or a recognised equivalent, is required given the hybrid connectivity and on-premises responsibilities

Nice to Have

• Fortinet NSE 4 or NSE 5 certification, relevant given the FortiGate firewall estate
• AWS Certified Security, Specialty and/or Microsoft Certified: Azure Network Engineer Associate (AZ-700)
• Experience with container network security: Kubernetes network policies, service mesh (Istio or equivalent), and east-west traffic control
• Hands-on experience with network security in regulated financial services: PCI DSS network segmentation, CBN guidelines, or equivalent
• Familiarity with SIEM platforms (Splunk, Microsoft Sentinel, or equivalent) and experience writing detection rules or correlation queries for network-based threats

Compensation

Competitive and commensurate with experience. Details shared with shortlisted candidates.