Own the technology and operational risk framework across platforms, cloud, data centre, SOC and NOC: a risk profile, tolerance and indicators for every critical service.
Run the go-live and service-acceptance risk gate with the COO: tested recovery, security testing, data protection assessment and named owners before any launch or takeover.
Own the risk profile of each product HT operates (digital banking, Converge, e- invoicing, open banking APIs): payments, fraud and data rules mapped to controls; threat modelling and penetration testing before each release; fraud and dispute indicators monthly; readiness sign-off before each new country.
Provide second-line challenge to the CISO, CTIO and Operations on security posture, patching, incident handling and change control.
Run quarterly access reviews across HT and client environments; oversee privileged and vendor access; verify joiner, mover and leaver controls and background screening with HR for everyone with client or sensitive access, including contractors.
Verify the service figures clients and management receive (availability, SLA attainment, incident response) before release; hold root-cause reviews after every major incident.
Build continuous control monitoring in Sentra (MFA, stale accounts, patching, access); report the monthly technology and operational risk view to EMC, feeding the CRO's Board report.
Deputise for the CRO at EMC, client forums and the IMS management review.
Why now
HT's growth lines are services it operates for others and products it runs for banks and Group companies; one Head of Risk cannot give independent assurance over all of them.
The Group audit lists IT Risk & Controls as a critical vacancy and key-person risk as HT's top issue.
External benchmark: Uptime Institute 2025: 54% of significant outages cost over US$100,000; 85% of human-error outages stem from procedures not followed. NIBSS: Nigerian financial institutions lost 52.26bn to fraud in 2024, up 196%. Verizon DBIR 2025: credential abuse is the leading breach vector.
Experience and qualifications
10+ years in technology risk, IT audit or IT risk consulting in a bank, payments company, telco or managed service provider
CISA or CRISC required; CISM, CFE or ISO/IEC 27001 Lead Auditor an advantage
Hands-on with cloud (AWS), digital banking or payments platforms, identity and access, and SOC/NOC operations
Working knowledge of CBN payments and cybersecurity rules and PCI DSS
Has presented to an executive committee Risks it leads on