Enterprise, Third-Party & Resilience Risk Manager

Heirs Technologies Limited empowers Africa’s Digital Transformation through innovative and locally tailored solutions. We partner to help build your business on technology designed for Africa and benchmarked against global standards, whether you are modernizing operations, strengthening resilience, or accelerating growth. We are recruiting to fill the position below:

Job Title: Enterprise, Third-Party & Resilience Risk Manager

Location: Lagos

Job Type: Full-Time What the Business Gets Contracts signed with liability, service credits, data terms and exit rights that match what partners owe HT, so margin on the ₦5.9bn licensing line is not given away in the small print A partner, OEM and supplier base that is selected, monitored and scored through the year, with exit plans for the critical ones Availability and recovery commitments (99.9% to 99.99%, 2 to 4 hours) backed by tests, so SLA credits and renewal risk fall, and a trained crisis team EMC and the Group get the risk register, indicators, losses and actions on every deadline, produced from Sentra, and the CRO's time back for judgement A risk champion in every practice, trained and running a self-assessment cycle: the Practice Blueprint's security and risk pillar made real Key Accountabilities Review client, partner and OEM contracts above an agreed threshold before signature: liability caps, indemnities, SLA credits, recovery commitments, data terms, audit rights and exit; keep client commitments and partner obligations back to back; own the contract standard with Legal. Run the third-party lifecycle for critical suppliers and partners: due diligence, tiering, scorecards, annual financial-health review, revenue-share reconciliation, exit plans; client due diligence and sanctions checks for new external and cross-border clients. Own the business continuity management system (ISO 22301): refresh the impact analysis, set recovery targets per critical service, run the annual exercise programme including recovery tests for client platforms, the SOC and NOC and joint tests with bank clients; validate recovery before new SLAs are signed. Stand up crisis management: named crisis team with legal and communications leads, one crisis protocol with the CISO and Marketing, ransomware playbook. Maintain Sentra (register, controls, indicators, actions, loss events); produce the monthly EMC dashboard, the monthly exception report and the quarterly Group submissions on deadline for the CRO; monitor risk appetite, client concentration and revenue at risk. Track audit, regulatory and certification findings to closure. Run the risk champion network and the annual risk and control self-assessment in every practice. Why now: Licensing and partnerships are 36% of FY27 revenue, with 37 renewals and new OEM financing; 2026 reviews found partner terms with no liability cap. Managed services and cloud sell availability; critical processes have never been exercised and the Board recorded continuity appetite as breached. Group deadlines allow no extension and are met by hand today. External benchmark: Verizon DBIR 2025: third-party involvement in breaches doubled to 30% in a year. Gartner: 45% of organisations had a third-party-caused business interruption in two years. BCI Horizon Scan 2025: cyber attacks, IT outages and third-party failure are three of the top five threats. Experience and