Head of GRC, Privacy & Advisory

About the role

Tenece Cybersecurity Services Limited is seeking an experienced leader to build and scale its Governance, Risk and Compliance (GRC), Privacy and Advisory practice across Ghana and Nigeria. The Head of GRC, Privacy & Advisory will drive high‑value consulting engagements, develop scalable service offerings and support revenue growth.

Key responsibilities

• Define and execute the strategy for the GRC, Privacy and Advisory business unit, establishing consulting methodologies, delivery standards and utilisation targets.
• Lead a team of GRC and cybersecurity advisory professionals, ensuring delivery of executive‑ready risk and compliance reports.
• Develop and standardise virtual CISO (vCISO) service frameworks and advise clients on security roadmaps, risk management and governance.
• Conduct compliance readiness assessments, gap analyses and support implementation of frameworks such as ISO 27001, SOC 2, CMMC, NIST CSF, HIPAA and PCI DSS.
• Advise on data‑privacy regulations including GDPR and CCPA, create remediation roadmaps and monitor regulatory changes.
• Collaborate with product, sales and solution teams to commercialise advisory services and expand managed security engagements.
• Oversee internal GRC activities, maintain policies, risk registers and report significant risks to senior management.

Required profile

• Bachelor’s degree in Cybersecurity, IT, Computer Science, Information Systems or related field; Master’s degree preferred.
• Minimum 8 years of cybersecurity experience with at least 4 years leading a compliance consulting, IT audit, internal controls or GRC practice.
• Experience in a Managed Security Services Provider, Big‑Four firm or specialised cybersecurity advisory organisation.
• Proven ability to advise senior executives, boards and legal teams and to drive revenue‑generating advisory services.

Required skills

• Strong knowledge of ISO 27001, SOC 2, CMMC, NIST 800‑53, NIST CSF, COBIT and TOGAF.
• Familiarity with privacy regulations such as GDPR, CCPA and country‑specific data‑protection laws.
• Practical experience with security control assessment, framework mapping, audit execution and regulatory compliance.
• Professional certifications (at least two): ISO 27001 Lead Implementer or Lead Auditor, CISA, CISM, CRISC, CCISO, CISSP.