Compliance, Data Protection & Certification Manager

Heirs Technologies Limited

We are recruiting to fill the position below:

Job Title: Compliance, Data Protection & Certification Manager

Location: Lagos

Job Type: Full-Time

Description

• Value to HT: HT keeps its licences, registrations, four ISO certificates and a clean regulatory record while handling other people's most sensitive data, and turns that into the assurance evidence that wins clients outside the Group.

What the business gets:

• One register of every obligation HT carries, each with an owner and evidence, so the business is never surprised by a regulator

• Data protection that bank, insurance and government clients audit and accept: impact assessments before go-live, processor agreements, breach handling on the 24- and 72-hour clocks

• Four ISO certificates that survive every surveillance audit, so the claims on HT's proposals are always backed

• One client assurance pack (certificates, policies, test summaries, SOC reports) that answers vendor due diligence in days: a direct enabler of the 25% external revenue target

• Licences, accreditations and tender certificates (e-invoicing, NITDA cloud, PenCom, NSITF) kept current, so no product or bid is blocked

• Key Accountabilities

• Own the obligations register and compliance calendar across the NDPC, CBN (through bank clients), NITDA, NRS, ngCERT, PCI SSC, PenCom, NSITF, ITF and the CAC; monthly attestation from each owner.

• Run the data protection programme with the DPO: registration, annual audit return, records of processing, impact assessments before high-risk processing, processor agreements with every client and sub-processor, transfer records and staff training.

• Own the regulatory incident clocks (client notice; 24-hour CBN through bank clients; 72-hour ngCERT and NDPC); keep and drill the playbook with the CISO and Legal.

• Plan and evidence data residency against the CBN circular and NITDA's sovereign data tiers before each deadline and market.

• Run the integrated management system across ISO 27001, 9001, 22301 and 20000-1: internal audit programme, management reviews, corrective actions, Statement of Applicability and the role managers' calendar; host the annual surveillance audit and the 2028 recertification; lead the ISO 9001:2026 transition and the ISO 27001 scope extension.

• Coordinate attestations with the CISO's team (SOC 2 Type II, SOC 1 readiness, PCI DSS service-provider readiness) and maintain the client assurance pack; answer due-diligence questionnaires within an agreed turnaround.

• Run the policy cycle on the Policy Hub; check marketing and bid claims so HT only claims what is certified; issue a quarterly regulatory update to EMC, feeding the CRO's Board report.

Why now:

• From 1 January 2027 HT holds payroll, health and loan data for seven companies and must meet data residency rules; e-invoicing licences carry uptime, testing and reporting conditions.

• External clients buy on certificates and attestations; one failed surveillance audit would put all four ISO certificates at risk, and the system is run by the CRO with no deputy.

• Experience and Qualifications

• 7+ years in compliance, data protection or management-system roles in a regulated technology company, fintech or bank

• Deep knowledge of the NDPA 2023 and GAID 2025; CBN and NITDA frameworks

• ISO/IEC 27001 Lead Auditor or Implementer; experience of at least one of ISO 9001, 22301 or 20000-1; SOC 2 or PCI DSS project experience

• NDPC-recognised DPO credential, CIPP/E or CIPM an advantage; legal training an advantage Risks it leads on

Framework categories: Regulatory, Compliance, Legal, Assurance:

• Regulatory and legal landscape

• Data protection: classification, records management, loss prevention policy

• Policies, standards and programme reporting

• Certification and attestation management

• Workforce awareness and training

• Marketing and bid claims control

• Year-one deliverables

• Every obligation has a named owner and evidence Q1 2027

• Impact assessments complete for all high-risk processing Before go-live / Q1 2027

• Annual data protection return filed; zero regulatory penalties 31 March 2027 / full year

• Open ISO improvement points closed; surveillance audit passed with no major nonconformity Q2 2027 / July 2027

• Client assurance pack live; questionnaires answered within 10 working days From Q2 2027

• SOC 2 issued; SOC 1 and PCI DSS readiness plans agreed; ISO 9001:2026 plan 2027

Measures of success:

• Obligations met on time: 100%
• High-risk processing with an impact assessment before go-live: 100%
• Major nonconformities at external audit: zero
• Client assurance requests answered on time: 90%
• Regulatory penalties: zero

Works with:

• DPO, Legal, HR, CISO, IMS role managers, certification body, Marketing and bid teams, external DPCO

Grows later with:

• IMS & Certification Officer (management system, surveillance audits, attestations, assurance pack) as external revenue and attestations grow.

Application Closing Date

Not Specified.