Compliance, Data Protection & Certification Manager

Heirs Technologies Limited empowers Africa’s Digital Transformation through innovative and locally tailored solutions. We partner to help build your business on technology designed for Africa and benchmarked against global standards, whether you are modernizing operations, strengthening resilience, or accelerating growth. We are recruiting to fill the position below:

Job Title: Compliance, Data Protection & Certification Manager

Location: Lagos

Job Type: Full-Time Description Value to HT: HT keeps its licences, registrations, four ISO certificates and a clean regulatory record while handling other people's most sensitive data, and turns that into the assurance evidence that wins clients outside the Group. What the business gets: One register of every obligation HT carries, each with an owner and evidence, so the business is never surprised by a regulator Data protection that bank, insurance and government clients audit and accept: impact assessments before go-live, processor agreements, breach handling on the 24- and 72-hour clocks Four ISO certificates that survive every surveillance audit, so the claims on HT's proposals are always backed One client assurance pack (certificates, policies, test summaries, SOC reports) that answers vendor due diligence in days: a direct enabler of the 25% external revenue target Licences, accreditations and tender certificates (e-invoicing, NITDA cloud, PenCom, NSITF) kept current, so no product or bid is blocked Key Accountabilities Own the obligations register and compliance calendar across the NDPC, CBN (through bank clients), NITDA, NRS, ngCERT, PCI SSC, PenCom, NSITF, ITF and the CAC; monthly attestation from each owner. Run the data protection programme with the DPO: registration, annual audit return, records of processing, impact assessments before high-risk processing, processor agreements with every client and sub-processor, transfer records and staff training. Own the regulatory incident clocks (client notice; 24-hour CBN through bank clients; 72-hour ngCERT and NDPC); keep and drill the playbook with the CISO and Legal. Plan and evidence data residency against the CBN circular and NITDA's sovereign data tiers before each deadline and market. Run the integrated management system across ISO 27001, 9001, 22301 and 20000-1: internal audit programme, management reviews, corrective actions, Statement of Applicability and the role managers' calendar; host the annual surveillance audit and the 2028 recertification; lead the ISO 9001:2026 transition and the ISO 27001 scope extension. Coordinate attestations with the CISO's team (SOC 2 Type II, SOC 1 readiness, PCI DSS service-provider readiness) and maintain the client assurance pack; answer due-diligence questionnaires within an agreed turnaround. Run the policy cycle on the Policy Hub; check marketing and bid claims so HT only claims what is certified; issue a quarterly regulatory update to EMC, feeding the CRO's Board report. Why now: From 1 January 2027 HT holds payroll, health and loan data for seven companies and must meet data residency rules; e-invoicing licences carry uptime, testing and reporting conditions. External clients buy on certificates and attestations; one failed surveillance audit would put all four ISO certificates at risk, and the system is run by the CRO with no deputy. Experience and