Practice Lead, Cybersecurity

The Practice Lead, Cybersecurity is the executive leader responsible for protecting the enterprise, enabling secure business growth, and ensuring the resilience of all digital platforms, products, and infrastructure across Heirs Technologies and its ecosystem.

This is a strategic and operational leadership role, accountable for building a world-class, risk-driven cybersecurity capability that safeguards:

• Customer data and digital banking platforms (e.g., RedApp)
• Enterprise platforms (e.g., Converge)
• Infrastructure, cloud environments, and integrations

The CISO will operate at the intersection of technology, risk, and business, ensuring security is not a blocker but a business enabler for growth, trust, and market expansion.

1. Enterprise Security Strategy & Leadership

• Define and execute a Group-wide cybersecurity strategy aligned to business growth and risk appetite
• Position cybersecurity as a business enabler for revenue, client trust, and market expansion
• Lead and scale a high-performing security organisation (GRC, SOC, Engineering, DevSecOps)
• Provide regular Board and EXCO reporting on cyber risk posture and mitigation

2. Platform & Product Security (Critical for HT)

• Ensure end-to-end security of:
• • Digital Banking platforms (RedApp)
  • Enterprise platforms (Converge)
• Embed security-by-design across all products and engineering squads
• Drive DevSecOps adoption across the SDLC

Outcome: Secure, scalable products that support revenue and client growth

3. Cyber Risk Management & Governance

• Establish and enforce a risk-based cybersecurity framework
• Identify, assess, and mitigate risks across:
• • Applications
  • Infrastructure
  • Third-party integrations
• Oversee data protection (PII, financial data, enterprise data)

4. Security Operations & Incident Response

• Build and lead a 24/7 SOC capability (in-house or managed)
• Oversee:
• • Threat detection (SIEM, EDR)
  • Vulnerability management
  • Penetration testing and red teaming
• Lead cyber incident response and crisis management

Outcome: Rapid detection, containment, and recovery from threats

5. Regulatory Compliance & External Engagement

• Ensure compliance with:
• • NDPA / NDPR
  • CBN Cybersecurity Framework
  • ISO 27001, PCI-DSS (where applicable)
• Serve as primary interface with regulators (CBN, SEC, NITDA, NCC)
• Drive audit readiness and certification programmes

6. Cloud, Infrastructure & Identity Security

• Secure cloud environments (AWS, Azure, GCP)
• Implement:
• • Zero Trust architecture
  • Identity & Access Management (IAM)
• Oversee endpoint, network, and infrastructure security

7. Third-Party & Ecosystem Security

• Lead vendor and partner security risk management
• Conduct security due diligence for all integrations and platforms
• Ensure ecosystem security across:
• • Fintech partners
  • Infrastructure vendors

8. Security Culture & Awareness

• Drive enterprise-wide cybersecurity awareness programmes
• Embed security into employee behaviour, engineering culture, and leadership mindset
• Lead initiatives such as:
• • Phishing simulations
  • Secure usage practices

SKILLS/ATTRIBUTES

Technical

• Cybersecurity architecture & enterprise security design
• Cloud security (AWS, Azure, GCP)
• Threat detection & incident response
• DevSecOps & secure SDLC
• Identity & access management (IAM)
• Data protection & privacy

Leadership

· Executive presence & Board engagement

• Strategic thinking & business alignment
• Crisis leadership and decision-making
• Stakeholder and regulatory management
• Ability to influence across engineering, product, and commercial teams

EDUCATION/EXPERIENCE REQUIREMENTS

Experience & Qualifications

• Bachelor’s degree in Computer Science, Cybersecurity, Engineering, or related field
• Master’s degree (MBA / MSc Cybersecurity)
• 12–15+ years in cybersecurity, with 5+ years in senior leadership roles
• Proven experience in:
• • Technology or financial services environments
  • Building and scaling enterprise security programmes
• Strong experience engaging:
• • Boards, regulators, and executive teams

Certifications (Required / Preferred)

• CISSP and/or CISM (required)
• Additional: CISA, CRISC, CEH, CCSP (advantage)
• Zero critical security breaches
• Reduction in vulnerabilities and incident frequency
• 100% compliance with regulatory and audit requirements
• Secure delivery of all major platforms (RedApp, Converge)
• Improved incident response time and recovery capability