Compliance, Data Protection & Certification Manager

About the role

Heirs Technologies, a privately held technology firm guiding African organisations through digital transformation, is hiring a Compliance, Data Protection & Certification Manager. The role owns the obligations register, runs the data protection programme with the DPO, manages regulatory incidents and oversees the integrated management system (ISO 27001, 9001, 22301, 20000-1) and certifications such as SOC 2 and PCI DSS.

Key responsibilities

• Own the obligations register and compliance calendar across the NDPC, CBN, NITDA, NRS, ngCERT, PCI SSC, PenCom, NSITF, ITF and the CAC, with monthly attestation from each owner.
• Run the data protection programme with the DPO: registration, annual audit return, records of processing, impact assessments before high-risk processing, processor agreements, transfer records and staff training.
• Own the regulatory incident clocks (client notice, 24-hour CBN clock, 72-hour ngCERT and NDPC clocks) and keep and drill the incident playbook with the CISO and Legal.
• Plan and evidence data residency against the CBN circular and NITDA's sovereign data tiers.
• Run the integrated management system: internal audit programme, management reviews, corrective actions, Statement of Applicability and managers' calendar; host the annual surveillance audit and the 2028 recertification; lead the ISO 9001:2026 transition and the ISO 27001 scope extension.
• Coordinate attestations (SOC 2 Type II, SOC 1 readiness, PCI DSS service-provider readiness), maintain the client assurance pack and answer due-diligence questionnaires on time.
• Run the policy cycle on the Policy Hub, check marketing and bid claims, and issue a quarterly regulatory update to EMC.

Required profile

• 7+ years in compliance, data protection or management-system roles in a regulated technology company, fintech or bank.
• Deep knowledge of the NDPA 2023 and GAID 2025, and of CBN and NITDA frameworks.
• NDPC-recognised DPO credential, CIPP/E or CIPM is an advantage; legal training is an advantage.

Required skills

• ISO/IEC 27001 Lead Auditor or Implementer; experience of at least one of ISO 9001, 22301 or 20000-1.
• SOC 2 or PCI DSS project experience.