Africa's Most Strategic Chief Information Security Officers 2025 December2025

VOL : 12 ISSUE : 523 2025

AFRICA'S MOST

STRATEGIC CHIEF

INFORMATION

Dr. Harrison Nnaji Chief Information Security Officer (CISO) First Bank Nigeria of Nigeria Limited

The Mind That Codes Trust into Africa’s Digital Future

www.thecioworldmedia.com

Your Legacy Featured

Where Leaders Make

Headlines.

Get Featured In

The CIO World Upcoming Edition Where Top Business Minds share their Success Stories.

SCAN T HE QR AND FILL THE FORM. — www.thecioworldmedia.com

Editorial Note

Guardians of Digital Trust

A

s Africa accelerates its digital transformation, the role of the Chief Information Security Officer (CISO) has evolved from a technical gatekeeper to a strategic architect of enterprise resilience. In an era defined by cloud adoption, mobile-first economies, cross-border data flows, and increasingly sophisticated cyber threats, security leadership has become inseparable from business continuity, regulatory trust, and long-term growth. Africa's Most Strategic Chief Information Security Officers 2025 is our editorial tribute to the leaders who are redefining cybersecurity as a boardroom priority and a catalyst for sustainable innovation.

Across the continent, organizations are navigating a complex threat landscape shaped by rapid digitization, skills shortages, legacy infrastructure, and evolving regulatory frameworks. Africa's CISOs operate at the intersection of these challenges, balancing risk management with innovation, and protection with enablement. The leaders featured in this edition exemplify a rare blend of technical depth, strategic foresight, and business acumen.

They understand that cybersecurity is no longer a reactive function, but a proactive discipline that underpins trust in digital ecosystems.

What distinguishes today's most strategic CISOs is their ability to align security with organizational objectives. These leaders engage directly with boards, regulators, and business heads, translating cyber risk into business language and measurable outcomes.

They champion security-by-design, embed resilience into digital initiatives, and foster a culture where cyber awareness extends beyond IT teams to every employee. In doing so, they transform security from a perceived cost center into a source of competitive advantage.

This edition also highlights how African CISOs are addressing region-specific realities with global relevance. From securing critical infrastructure and financial systems to protecting emerging fintech, telecom, healthcare, and government platforms, these leaders are building frameworks that are both robust and adaptive. Their strategies emphasize collaboration—across industries, borders, and public-private partnerships—recognizing that cybersecurity resilience is a shared responsibility.

Africa's Most Strategic Chief Information Security Officers 2025 celebrates leadership that is measured not only by incident prevention, but by preparedness, response maturity, and the ability to lead through uncertainty. As cyber risks continue to evolve, the influence of these CISOs will only grow stronger. They are not merely defending systems; they are safeguarding digital trust, enabling innovation, and shaping the future of Africa's digital economy with confidence, clarity, and conviction.

CIO

T H E F RO N T PAG E E XC LU S I V E

08.

Dr. Harrison Nnaji The Mind That Codes Trust into Africa’s Digital Future

INDUSTRY INSIGHTS

16.

Managing Risk in Real Time The CISO's Blueprint for Cyber Resilience

18.

The Trusted Guardian Building Executive Condence Through Cyber Leadership

Editor-in-Chief

Thanh Truong

Deputy Editor

Sam Carter

Managing Editor

Alaya Brown

Assistant Editor

Maria Evans

Visualizer

Chris Carter

Art & Design Head

Millie Simon

Art & Design Assitant

Judy Smith

Business Development Manager

Phoebe Jacob

Business Development Executives

Aisha, Olivia

Technical Head

David Walker

Assitant Technical Head

Mia Rodricks

Digital Marketing Manager

Helena Smith

Research Analyst Circulation Manager

Eric Smith Richard Martinez

Follow us on www.facebook.com/thecioworld www.x.com/thecioworld We are also available on

RNI No.: MAHENG/2018/75953

Copyright © 2025 The CIO World, All rights reserved. The content and images used in this magazine should not be reproduced or transmitted in any form or by any means, electronic, mechanical, photocopying, recording or otherwise, without prior permission from The CIO World. Reprint rights remain solely with The CIO World.

Africa's Most Strategic Chief Information Security Officers 2025

T H E F R O N T PAG E E XC LU S I V E

DR. DR. HARRISON

NNAJI

The Mind That Codes Trust into Africa’s Digital Future

Dr. Harrison Nnaji

Chief Information Security Officer (CISO) | First Bank of Nigeria Limited

.

W

hile some leaders build walls of defence and set territorial boundaries, others create systems that are fluid, intelligent, and deeply intuitive, not only to defend but also to adapt, anticipate, collaborate, cocreate, and evolve. Thus, the most effective cybersecurity approaches in the modern threat environment are not those that require spotlight, but the practitioners that operate behind the scenes to build resilient organisations that endure during challenging times. Strategic security practices are not reactive, but intelligent, proactive, and architecturally embedded. It is about integrating the cyber defence vision into the organisational DNA, powering the digital ecosystem, operational imperatives, and digital transformation.

This is the philosophy that defines Dr. Harrison Nnaji. His cross-sector experience, spanning circa 20 years and encompassing fields such as banking, telecoms, OEMs, and multifaceted integration settings, makes him one of the most visionary information security leaders on the continent. Possessing an academic arsenal comprising four (4) master's degrees, a Ph.D. in Management, Leadership, and Organisational Strategy, a second Ph.D. in Offensive Engineering, and a background in Electrical and Electronics Engineering, Dr. Nnaji combines technical expertise with the vision and wherewithal of an executive.

His contribution is precise, clear and has a long-range impact, whether it is in defending the digital ecosystem of several enterprise-grade organisations, supporting the breeding and grooming of the cybersecurity experts of the future, or in working with national and regional stakeholders to shape policies and frameworks. With his global thought leadership, industry acumen, and diplomacy, Dr. Nnaji is not simply securing the data, but rather building the future of cybersecurity practices in Africa in a purposedriven and undeniable fashion.

Elevating FirstBank’s Digital Security and Operational Efficiency The core mission of FirstBank’s cybersecurity program is to consistently and continuously secure and protect the Bank’s digital infrastructure, customer trust, operational integrity, and the digital transformation aspirations of the Bank, while maximally supporting and promoting operational efficiencies. This mission is currently guided by a knitted and evolving cybersecurity strategic cycle and evolutionary practices. Harrison mentions, “The strategic vision is to continue to evolutionarily elevate and sustainably improve FirstBank’s cybersecurity maturity to support its ambition of becoming one of Africa’s top 10 banks and Nigeria’s most profitable, enduring, and economically impactful financial institution.”

The strategic vision is to continue to evolutionarily elevate and sustainably improve FirstBank’s cybersecurity maturity to support its ambition of becoming one of Africa’s top 10 banks and Nigeria’s most profitable, enduring, and economically impactful financial institution.

Strategic Integration and Autonomous Defence at FirstBank Resilience and agility, under Harrison’s leadership, are realised through the strategic integration of technology, people, and processes into the depth and breadth of organisational practices and imperatives, including the implementation of AI-powered threat detection, cloud and infrastructure security, and autonomous security operations.

These advanced capabilities facilitate rapid threat detection, containment, and response, while ensuring the continuity and reliability of banking services. A risk-based methodology, aligned with NIST, ISO27001, and applicable regulatory standards, has enabled the Bank to uphold and advance its cyber-defence objectives through the evolving strategic cycle, reflecting the maturity and strength of its cybersecurity posture and long-term vision.

Security as a Shared Responsibility Executive leadership, under Harrison’s guidance, plays a pivotal role in embedding a security-first culture. As CISO, he collaborates closely with strategic business units, support

This top-down and bottomup commitment has fostered a cyber-aware workforce and a collaborative environment where security is everyone’s responsibility, from frontline staff, through executive management, to Board members.

functions, the Executive Management team, and the Board to ensure cybersecurity is seamlessly integrated into both the business strategy and operational imperatives. He states, “This top-down and bottom-up commitment has fostered a cyber-aware workforce and a collaborative environment where security is everyone’s responsibility, from frontline staff, through executive management, to Board members.”

Protecting Digital Progress Under Harrison’s leadership, cybersecurity strategies are closely aligned with FirstBank’s digital transformation agenda, business objectives, and operational priorities.

“Each cybersecurity strategic cycle reinforces secure digital channels, improves operational maturity, and advances the adaptability and embedment of emerging technologies, ensuring that innovation remains aligned with business, security, and compliance expectations,” highlights Harrison. This strategic alignment enables the Bank to deliver cutting-edge financial services while maintaining adaptable security, regulatory compliance, and effective protection against cyber threats and digital fraud.

Advancing Customer Trust Riding on the strategic directions of the Bank, Harrison has led the advancement into a realm where customers can be further protected by the Bank, even when they knowingly

or unknowingly compromise their digital transaction credentials. He asserts, “We are also adopting and deploying AI-powered digital fraud management systems that can iteratively detect changes in the behavioural patterns of customers' transactions and take prompt and proactive steps to restrict, minimise, and prevent financial losses.” This approach is delivering significant benefits, and customers have responded with appreciative satisfaction. In addition, several other innovative capabilities and technologies have been implemented within the digital ecosystem, enabling the Bank to remain focused on its strategic aspirations while creating optimal value for the staff, customers, and shareholders.

Driving Cyber Resilience in Digital Banking Balancing regulatory compliance, customer data protection, and the need to provide seamless digital banking experiences, Harrison drives a comprehensive cybersecurity strategy that ensures compliance with the Cybercrime Act 2015, Central Bank guidelines and frameworks, GDPR, NDPR, and other relevant standards and requirements across the geographies of operation. Compliance, data security, and product functionality are all considered and integrated from the design stage, enabling the harmonious coordination of all prevailing requirements to deliver products and services that are functional, compliant, secure, and user-friendly. This evolutionary approach has continued to mature over time, promptly recognising and reflecting the changes in customer needs and preferences, economic and regulatory landscapes, and advancement in technological opportunities.

Evolving Security Engineering and Intelligence The most pressing threats include social engineering, ransomware, third-party risks, supply chain risks, phishing, account takeover, insider threats, and AI-driven attacks.

Under Harrison’s leadership, FirstBank promptly detects and mitigates these risks through a strategy referred to as defence-in-depth, zero-trust, layered and coordinated security defence. This is achieved through enhanced threat intelligence reports, advanced and evolving security engineering, and operational efficiencies, including targeted security awareness and 24/7 monitoring. These proactive measures help to enable strong defence and mitigation capabilities against both established and emerging threats.

Proactive Risk Containment Enterprise risk management, under Harrison’s direction, is structured around the information and cybersecurity risk framework, which defines governance requirements across three lines of defence—ownership, oversight, and assurance.

Cybersecurity expectations are also codified in the employee handbook, contracts, Master Services Agreements, Service Level Agreements, and safe use policies.

Incident response plans are integrated with threat detection and forensic capabilities, escalation, and communication mechanisms, enabling rapid detection, containment, mitigation, and recovery. This approach ensures that risks are managed effectively, and incidents are detected and addressed promptly.

Securing the Supply Chain Third-party and vendor risks, under Harrison’s oversight, are assessed through a rigorous and evolving process that includes a third-party onboarding framework, on-site evaluations, feedback escalation, and strategic collaboration. He points out, “the coordinated approach ensures that external entities maintain and support the recommended security standards as FirstBank’s expected operations, reducing and promptly managing the exposure to vulnerabilities introduced through partnerships.” At FirstBank, the risk management approach has also evolved from third-party risk to addressing multi-tier supplier risks, mandating deeper engagement into the value chain to ensure every entity supporting the Bank’s services and products adopts recommended cybersecurity best practices, which are revalidated on-demand and at least annually.

Building a Cyber-Aware Culture Under Harrison’s leadership, FirstBank has continued to implement multi-pronged security awareness initiatives, including cybersecurity awareness programmes for all

employees, third parties, partners, customers, and Board members, as well as career webinars and training sessions on emerging threats and technologies. “Cybersecurity expectations are also codified in the employee handbook, contracts, Master Services Agreements, Service Level Agreements, and safe use policies,” mentioned Harrison.

These efforts ensure that cybersecurity knowledge permeates every level of the organisation, partner, and customer ecosystem, empowering both technical and nontechnical personnel with the appropriate knowledge and awareness to recognise and respond to potential threats effectively and sustainably.

Harrison’s Contributions to Standards and Policy Engagement with external stakeholders, led by Harrison, includes active participation in professional bodies such as ISSAN (Information Security Society of Africa – Nigeria), CSEAN (Cyber Security Experts Association of Nigeria), CCISONFI (Committee of Chief Information Security Officers of Nigerian Financial Institutions), ISACA – Nigeria, ISC2 (International Information System Security Certification Consortium), PCI SSC, and BSI; collaboration with regulators, and contributions to national and regional cybersecurity standards. Beyond global involvement in numerous opinion- and direction-shaping conferences and forums, the FirstBank Group CISO is also a member of several advisory bodies that influence the digital and cybersecurity ecosystems. These interactions serve to elevate awareness, shape policy, groom practitioners, and promote a unified approach to cybersecurity practices across the financial sector and the broader economy.

Mentoring Tomorrow’s Cyber Leaders The legacy envisioned under Harrison’s leadership is one of transformation, collaboration, co-creation, coopetition, resilience, and an unwavering empowerment drive for the cybersecurity workforce to aspire higher and achieve greater goals. He shares, “Through leadership strides at FirstBank, the goal is to continue to set higher benchmarks in cybersecurity maturity, mentor future leaders & practitioners, and contribute meaningfully to Nigeria’s and Africa’s cybersecurity landscape while optimally promoting digitalisation and digital transformations.” This vision includes fostering a culture of embedded security and heightened innovation, ultimately shaping the future of digital trust in financial services for the overall benefit of mankind.

THE

CISO's BLUEPRINT FOR

CYBER RESILIENCE

C

yber risk is no longer something that can be anticipated within a certain period. In fact, threats are coming out, developing, and intensifying all the time, and very often, they are doing so at a speed that is beyond the capability of traditional governance, controls, and response frameworks to handle. Therefore, cyber resilience in such a setting is not something that can be achieved by relying on static defenses or annual risk assessments. Rather, it is the outcome of continuous awareness, quick decision-making, and management that considers cybersecurity a living, operational discipline. The CISO who is designing resilience in motion is, thus, at the core of this transition.

16 www.thecioworldmedia.com

From Periodic Risk Management to Continuous Risk Awareness It was a conventional practice in cyber risk management to put the main focus on periodic reviews, compliance checklists, and retrospective analysis. However, the alwayson threat landscape has made these approaches obsolete.

Present-day CISOs act on the basis of continuous risk awareness and hence, they use the real-time telemetry alongside threat intelligence and behavioral analytics to get the exposure as it varies.

Managing Risk in Real Time Managing risk in real-time implies that on top of knowing what might go wrong, one has to understand which factors are changing right now. It enables prioritization of actions to be done dynamically thus, organizations can react to the most appropriate threats instead of the ones that are most familiar.

Visibility as the Foundation of Resilience Cyber resilience starts with visibility. For that reason, CISOs have to recognize overarching insight within the networks, cloud environments, endpoints, identities, and third-party connections. The risk is that without visibility, it becomes invisible, hence, the response is inevitably reactive.

Nowadays, real-time dashboards, unified security platforms, and integrated data sources facilitate CISOs to keep the operational picture clear. Such visibility is conducive to the organization's being in a position to detect more quickly, prioritize better, and decide with more confidence even under pressure. The premise of risk management in real time is seeing it in real-time.

Speed Without Chaos Speed without structure leads to chaos, which is why the CISO's plan highlights the need for disciplined agility, i.e., having clear decision thresholds, predefined response paths, and automation that operates within controlled boundaries.

In an incident situation, a CISOs defining the automating actions and those needing human judgment mitigates the risk of hesitancy. The response is thus, rapid but thoughtful, ensuring the continued possession of control whilst speeding up containment and recovery.

Intelligence Over Volume Today the security teams' situation is characterized by the overflow of alerts, with most of them being of low-value and redundant. The key to cyber resilience is not in the volume of data but in the quality of the intelligence.

Advanced technologies help CISOs to focus on the signal and not the noise by bringing to the surface the useful instances for instance with the help of the analytics and machine learning.

To guide prioritization, threat context, business impact, and probability of exploitation are used. This intelligence-driven methodology ensures that the focus of attention and

resources goes where the risk level is high and not where the alerts are the loudest Embedding Cyber Risk into Business Operations Cyber real-time resilience is not something that can be achieved by the business operating in isolation. CISOs have been increasingly incorporating the aspects of cyber risk into everyday business decision-making, digital transformation, and enterprise risk management.

When security is in harmony with business processes, risk trade-offs become transparent and manageable. Executives will be in a position to weigh the pros and cons of speed, innovation, and exposure and still be sure that the cyber implications are well understood and taken care of.

Governance That Supports Rapid Action Well-functioning governance structures are not the ones that hamper the response time, but rather the ones that make it possible. CIOS build governance systems that explain the areas of authority as well as the support and accountability routes well before the occurrence of the incidents. Such exactness at the crucial time abolishes hesitancy and confusion.

The definition of roles and the pre-authorization of decisions allow companies to take real-time actions without being obliged to seek consensus or approval chains.

Measuring Resilience, Not Just Risk Classic indicators show mainly the weaknesses, incidents, and compliance of a company. The CISO's plan broadens the evaluation to also include the signs of resilience: e.g., how fast the detection is, the response time, recovery effectiveness, and learning cycles.

These metrics move prevention of every incident as the main aim of the organization to that of lessening the impact and improving the response. The degree to which the organization changes is the benchmark for resilience rather than the absence of threats. Real-time risk management is the core of cyber resilience.

Those companies that adopt this model are not limited to static security only but are capable of moving towards adaptive defense where awareness is constant, response is immediate, and resilience is built into the everyday activities of the business.

www.thecioworldmedia.com

17

The Trusted Guardian

Building

Executive Confidence Through

CYBER LEADERSHIP

C

ybersecurity is a single one of the biggest leadership challenges that the modern business has encountered. The cyber risk that used to be handled by the IT departments, is now the main concern of the board executives and hence, affects the strategy, reputation, exposure to the regulatory, and long-term value creation of

18 www.thecioworldmedia.com

the company. Cyber leadership in such a case cannot only be about technology controls; the ultimate importance is trust. The best cyber leaders are those who act as trusted custodians, thereby, they give the freedom to the executives for making brave decisions in an unpredictable digital environment.

Cyber Leadership as Executive Enablement

Calm Leadership During High-Stakes Moments

Cyber leaders are not expected by the modern executives to completely get rid of risks. They expect instead, from them, to be clear, farsighted, and judicious. Cyber leadership enhances executive trust by offering a translation of complex technical threats into understandable business implications. When the leaders get to know what is at risk, what is safe, and what needs to be done, then cybersecurity becomes not a source of worry, but a basis for taking wellinformed decisions.

Cyber incidents more than anything else can put the confidence of the leaders to a test. They usually evolve rapidly, attract the attention of the media and create pressure on the leaders to make a quick decision. Therefore, having a calm and prepared cyber leader at that time is very important.

The trusted guardian is not a person who bombards the leadership with technical specifics. Instead, they offer viewpoint - what is the most important, where the company is vulnerable, and how the risk is being controlled actively.

Trust Built Through Visibility and Transparency One of the main reasons for the increase in confidence of the leaders is their insight into the cyber security of the organization. Proper cyber leadership leads to the creation of the transparency that is based on the presence of the threats, vulnerabilities, and readiness for the response but without creating any fear or confusion. This also means frequent and well-organized communication with the executives whose main focus should be risk trends, resilience, and preparedness rather than single cases.

Being transparent also means being honest. Trusted cyber leaders admit their shortcomings, clearly express the uncertainty, and do not provide false benefits. This trustworthiness opens the way for close executive-cyber leaders relations and it works like a reinforcement of the trust also in the times of incidents or disruption.

The trusted guardian is the one who makes the disorder into a well-organized situation; he/she/it determines what has been discovered, what are the actions being run, and which decisions require the executives' input. Such a calmness brings about a stabilizing effect on the leadership teams and thus, the teams are protected from reactive decisions which are influenced by the fear and not the facts. The confidence of the leaders is strengthened when they observe the cyber leaders who are in control, are disciplined, and take responsibility.

Human-Centered Cyber Leadership After all, the core of the cybersecurity is to secure the people—employees, customers, partners, and stakeholders.

The trusted guardians are aware of the human aspect in cyber risks and hence liaise with empathy. They know that the leadership teams get stressed due to cyber issues and so they give them assurance in the form of clarity and cooperation instead of rushing to warn them.

The human-centered style makes the relationship stronger between the members of the executive team and it helps to position the cyber leader as a collaborator rather than an enforcer.

From Security Function to Leadership Capability

Aligning Cybersecurity with Business Strategy By aligning the safety needs with the business goals, cyber leadership is able to keep the position at the executive table.

Instead of constraining the business through cybersecurity, the trusted guardians present it as a facilitator of the growth, the innovation, and the operational continuity.

Regardless of being used to digital transformation, cloud migration, mergers, or market expansion, cyber leaders first explain to the executives how the security investments protect the strategic ambitions. Such coordination gives the board a sense of assurance that the decisions regarding cybersecurity are rooted in business value not in the avoidance of abstract risk.

The development of cybersecurity as a leadership skill is a major change point. Once the cyber leaders show strategic insight, emotional intelligence, and business acumen, they are no longer mere technical specialists but become trusted advisors.

One of the main reasons for the executive confidence to increase is that cybersecurity is handled by people who are aware of both risk and responsibility- individuals who can guard the organization without hindering it and who can lead the way to the leaders through the uncertain territory with trust and credibility.

www.thecioworldmedia.com

19

2024

2025

THECIOWORLDMEDIA Get THECIOWORLDMEDIA Magazine in Print,&

Digital on www.thecioworldmedia.com