Associate Operations Manager

Job Description

Purpose of the role

The Associate Operations Manager is second-in-command of operations across all three companies and deputises for the Operations Manager. The role combines two things: running the group's business operations day to day and acting as a senior investigative authority who makes sure the work delivered by the forensics lab, incident response and litigation support teams is accurate, defensible and consistent. It needs someone with very senior experience in both operations and investigations, who can hold their own with investigators, clients, lawyers and the courts as well as with finance and the executive team.

Key responsibilities

1. Group operational management

• Manage day-to-day operations across Cyanre, CyberCom and Lextrado EDS, making sure the three companies work as one service, from breach response through lab analysis to litigation support.
• Own cross-entity handoffs, so that evidence, findings and case files move between incident response, the lab and Lextrado EDS without gaps in chain of custody or quality.
• Lead group-wide capacity and resource planning, and redeploy people across companies to meet peaks in demand.
• Oversee service delivery against client contracts, retainers and SLAs, and step in on engagements at risk.
• Act as senior escalation point for major incidents, high-profile matters and client complaints.

2. Business operations

• Manage operational budgets for the operations function, controlling costs and tracking spend against plan.
• Monitor and report on utilisation, billing, time capture and work-in-progress, and work with finance to keep billing accurate and timely.
• Oversee procurement, vendor and licence management for forensic, IR and eDiscovery technology, and contracts with key suppliers.
• Oversee facilities, lab infrastructure, evidence storage and operational IT, and keep business continuity and disaster recovery plans current.
• Lead operational projects and change initiatives, such as new tooling, process redesign and service launches.
• Produce executive operational reporting and management information for the Operations Manager and Managing Director.

3. Investigative oversight and senior casework

• Act as senior reviewer for investigations across all three companies, including incident response, digital forensic examinations and eDiscovery matters.
• Personally lead or act as Incident Leader on the most sensitive, high-profile or complex matters.
• Make sure methodology is applied consistently across teams, and that findings are supported by evidence and clearly separated from assumptions.
• Sign off reports, affidavits and expert findings where required, and give expert testimony in civil and criminal proceedings.
• Advise clients, counsel and insurers on investigative strategy, scope and the limits of the evidence.

4. Quality, compliance and risk

• Maintain the operational parts of the group's ISO 27001 management system and lab quality practices aligned to ISO/IEC 17025, ISO/IEC 27037 and ISO/IEC 27035.
• Oversee evidence handling, chain of custody, secure storage and retention across the group.
• Make sure operations comply with POPIA, the Cybercrimes Act, and the requirements of legal privilege and court procedure.
• Own the operational risk register, lead internal and external audits, and track corrective actions to closure.
• Lead quality assurance and post-incident review programmes, and feed lessons into methodology and training.

5. People leadership

• Manage team leads and managers across the three companies: objectives, performance reviews, coaching and underperformance.
• Lead workforce planning, recruitment, onboarding and succession planning for operational and investigative roles.
• Own training and certification plans across the group, and maintain a culture of rigour, integrity and continuous learning.
• Monitor workload and wellbeing, especially after major incidents, and keep on-call arrangements sustainable.

6. Deputising for the Operations Manager

• Deputise for the Operations Manager with full operational authority when they are away.
• Represent operations at executive, client and governance meetings as required.
• Contribute to operational strategy, budgeting and planning for the group.

Key performance indicators

• Engagements delivered on time and to standard against SLAs and client commitments, across all three companies.
• Quality and defensibility of work: QA findings, client feedback and outcomes of legal or peer challenge.
• Operational spend against budget, utilisation, and billing accuracy and timeliness.
• Audit outcomes and corrective actions closed on time.
• Chain-of-custody and evidence register integrity.
• Team retention, performance review completion, certification progress and succession readiness.

Qualifications

Minimum requirements

• 12+ years' experience in digital forensics, incident response or cyber investigations, at least 8 of them at a senior level.
• At least 5 years managing operations or multiple teams in a professional services, forensics, cyber security or legal services environment.
• Senior hands-on investigative experience in at least two of: digital forensic examinations, incident response, and eDiscovery/litigation support.
• A track record of managing operational budgets, resourcing and service delivery across multiple concurrent client engagements.
• Experience giving expert evidence or preparing affidavits and expert reports for South African courts.
• In-depth knowledge of evidence handling, chain of custody and forensic quality standards.
• Working knowledge of POPIA, the Cybercrimes Act, ECTA and legal privilege.
• Experience operating within a formal management system (ISO 27001, ISO/IEC 17025 or similar).
• Relevant degree in computer science, information security, digital forensics or business, or equivalent experience.
• Able to pass criminal record, credit and qualification checks; valid driver's licence.

Advantageous

• Senior forensics or IR certifications, e.g. GIAC GCFA, GCIH, GCIM; EnCE; CREST CCIM.
• Management or governance certifications, e.g. CISM, CISSP, ISO 27001 Lead Implementer or Lead Auditor.
• Business or management qualification (e.g. MBA, PMP, ITIL).
• eDiscovery platform experience or certification (e.g. Relativity, Nuix).
• Experience in an ISO/IEC 17025-accredited forensic laboratory.
• PCI Forensic Investigator (PFI) experience.
• Background in law enforcement, regulatory or major investigations.

Additional Information

Competencies

• Operational leadership: keeps a complex, multi-company operation running and makes sound calls on priorities and resources.
• Investigative judgement: follows the evidence, challenges weak conclusions and states the limits of what is known.
• Business acumen: understands cost, utilisation and billing, and makes decisions that keep the operation sustainable.
• Composure under pressure: stays steady and decisive when major incidents and urgent matters collide.
• Communication and influence: credible with investigators, clients, lawyers, the courts and the executive team.
• Integrity and discretion: handles sensitive client and case information with care and protects the defensibility of the work.
• People leadership: develops managers, sets clear expectations and holds standards across teams.

Working conditions

• Office-based in Gauteng, with client site, lab and court attendance as matters require.
• Extended hours and escalation duties during major incidents and urgent legal deadlines.
• Travel within South Africa, and occasionally regionally, as engagements require.