Technology, Platforms & Operational Risk Manager

Value to HT: Every platform and managed service HT sells is proven safe to run before it is switched on, resists fraud and misuse while clients depend on it, and the engineers who touch client systems are vetted and controlled.

What the business gets

• Managed services, cloud, SOC and products (₦9.3bn) run on tested controls, so outages, SLA credits and client exits are prevented rather than explained

• No go-live or service takeover without tested recovery, security testing, a data protection assessment and named owners

• Platforms that pass bank and regulator scrutiny on payments rules, fraud controls and resilience before launch, with fraud managed as a measured risk

• Privileged and client access that is approved, reviewed every quarter and removed on the day someone leaves; screening verified for everyone with client access

• A technology risk view EMC can act on each month, independent of the teams that build and run the services, and cover for the CRO

Key accountabilities

1. Own the technology and operational risk framework across platforms, cloud, data centre, SOC and NOC: a risk profile, tolerance and indicators for every critical service.

2. Run the go-live and service-acceptance risk gate with the COO: tested recovery, security testing, data protection assessment and named owners before any launch or takeover.

3. Own the risk profile of each product HT operates (digital banking, Converge, e- invoicing, open banking APIs): payments, fraud and data rules mapped to controls; threat modelling and penetration testing before each release; fraud and dispute indicators monthly; readiness sign-off before each new country.

4. Provide second-line challenge to the CISO, CTIO and Operations on security posture, patching, incident handling and change control.

5. Run quarterly access reviews across HT and client environments; oversee privileged and vendor access; verify joiner, mover and leaver controls and background screening with HR for everyone with client or sensitive access, including contractors.

6. Verify the service figures clients and management receive (availability, SLA attainment, incident response) before release; hold root-cause reviews after every major incident.

7. Build continuous control monitoring in Sentra (MFA, stale accounts, patching, access); report the monthly technology and operational risk view to EMC, feeding the CRO's Board report.

8. Deputise for the CRO at EMC, client forums and the IMS management review.

Why now

• HT's growth lines are services it operates for others and products it runs for banks and Group companies; one Head of Risk cannot give independent assurance over all of them.

• The Group audit lists IT Risk & Controls as a critical vacancy and key-person risk as HT's top issue.

External benchmark: Uptime Institute 2025: 54% of significant outages cost over US$100,000; 85% of human-error outages stem from procedures not followed. NIBSS: Nigerian financial institutions lost ₦52.26bn to fraud in 2024, up 196%. Verizon DBIR 2025: credential abuse is the leading breach vector.

Experience and qualifications

• 10+ years in technology risk, IT audit or IT risk consulting in a bank, payments company, telco or managed service provider

• CISA or CRISC required; CISM, CFE or ISO/IEC 27001 Lead Auditor an advantage

• Hands-on with cloud (AWS), digital banking or payments platforms, identity and access, and SOC/NOC operations

• Working knowledge of CBN payments and cybersecurity rules and PCI DSS

• Has presented to an executive committee Risks it leads on

Framework categories: Technology, Operational, Emerging, Reputational

• Programme governance, cyber strategy and change management challenge

• Software security, infrastructure security and threat and vulnerability management for flagship products

• Cloud security: provider inventory, controls baseline, compliance

• Identity and access management; workforce screening, phishing and awareness

• Monitoring: logs, SIEM, cyber risk analytics, metrics

• Fraud monitoring and payments-rule compliance on platforms

Strategy lines it protects

Reseller to operator; Integrator to product vendor.

Managed services ₦2.59bn; cloud, data centre and NOC ₦1.72bn; cybersecurity ₦1.33bn; products ₦3.66bn

Year-one deliverables

Risk profile, tolerance and indicators for every critical service - Q1 2027

Go-live and takeover gate in operation - From Q2 2027

Control matrix signed off before every platform launch; fraud indicators monthl Each launch / from Q1 2027-

Quarterly access reviews; leaver access removed within 24 hours; screening verified for all client-access staff From Q1 2027 / Q2 2027

Client service figures verified before release - From Q1 2027

Named, ready deputy for the CRO - Q2 2027

Measures of success

• Critical services with a current risk profile: 100%

• Launches and takeovers through the gate: 100%

• Reported vs verified service figures: no material gap

• Access reviews on time: 100%; privileged staff with current screening: 100%

• Fraud loss rate and dispute volume: falling

Works with: CTIO, CISO, COO, HR, practice leads, product owners, SOC and platform partners, client risk forums

Grows later with: IT Risk & Controls Analyst (access reviews, screening verification, continuous monitoring); Platform & Fraud Risk Analyst (fraud monitoring, new-country readiness) when platforms expand across borders.