Founding Chief Platform Officer (CPO)

FOUNDING HEAD OF PLATFORM ENGINEERING, SECURITY AND CLIENT DELIVERY

ABOUT CCMC

Credible Capital Management Company (CCMC) is the creator of Portivue, a configurable, white-labelled platform for portfolio oversight, governance, financial performance, document control, stakeholder reporting and institutional workflows.

The core platform and demonstration environment have been built. CCMC is now moving from founder-led development into controlled client deployment and commercial operation.

We are seeking a senior, hands-on technology leader to turn this foundation into a secure, reliable and scalable service.

THE ROLE

The Founding Head of Platform Engineering, Security and Client Delivery will assume technical ownership of Portivue and help determine its long-term architecture and operating standards.

This is not a role for someone who only delegates. The successful candidate must be able to inspect, improve, secure and operate the platform personally while establishing the processes and future technical team required for growth.

You will work directly with CCMC’s founder, Phillip J. Mostert. The founder will lead product vision, institutional workflows, commercial strategy and customer relationships. You will translate that vision into reliable architecture, secure client environments and repeatable delivery.

KEY RESPONSIBILITIES

Platform engineering

• Assume technical ownership of Portivue.

• Review and document its codebase, architecture, databases, authentication, file storage and integrations.

• Inspect, test and correct AI-generated code.

• Develop agreed functionality while protecting working components.

• Establish development, testing, release, rollback and production procedures.

• Maintain version control, change records and technical documentation.

• Prioritise technical debt according to security, reliability and commercial risk.

• Develop an architecture roadmap, including when components should be hardened, replaced or migrated.

• Reduce unnecessary dependence on any single technology or infrastructure provider.

Security and operations

• Strengthen authentication, authorisation, administrator access and user permissions.

• Secure databases, APIs, uploaded documents and administration functions.

• Test for inappropriate public or cross-client access to private information.

• Implement server-side validation, rate limiting, secrets protection and abuse controls.

• Assess Portivue against recognised application-security principles.

• Coordinate vulnerability remediation and independent security testing.

• Establish security logging and incident-response procedures.

• Ensure security statements are supported by technical evidence.

• Support POPIA-related technical safeguards alongside appropriate specialists.

• Verify backup, restoration and disaster-recovery capabilities.

• Oversee hosting, monitoring, releases, migrations and technical suppliers.

• Document relevant application, database, file-storage and backup locations.

Client delivery and support

• Convert the master platform into separately configured, white-labelled client environments.

• Translate client structures, roles and reporting needs into controlled configurations.

• Manage branding, domains, permissions, testing and launch readiness.

• Protect the core platform while implementing approved client requirements.

• Establish repeatable onboarding, deployment and offboarding processes.

• Separate standard configuration from chargeable custom development.

• Produce reliable estimates and implementation plans.

• Train customer administrators to manage users and populate their own environments.

• Support demonstrations, proposals and customer due diligence.

• Establish technical-support and incident-management processes.

• Convert recurring issues into product improvements.

• Contribute technical information to pricing and proposals.

• Prevent uncontrolled customisation from fragmenting the core product.

• Recruit and supervise future technical personnel.

INITIAL MANDATE

• Complete a technical, architecture and security assessment.

• Document the database, storage and access-control model.

• Remedy critical security and reliability risks.

• Establish a controlled master version of Portivue.

• Implement testing, release, rollback and recovery procedures.

• Standardise permissions and client-deployment controls.

• Support an initial controlled client implementation.

• Deliver a practical 12-month technical and security roadmap.

REQUIRED EXPERIENCE

We are looking for a senior professional with substantial experience taking business applications into secure, reliable production use.

• Full-stack web-application development.

• JavaScript or TypeScript and modern front-end frameworks.

• Backend development, APIs and server-side validation.

• Database architecture, authentication and access control.

• Secure file storage and document access.

• Cloud-hosted operations, DNS, SSL and domains.

• Monitoring, backups, disaster recovery and incident response.

• Version control and controlled deployments.

• Application security and production troubleshooting.

• Reviewing and correcting AI-generated code.

• Client implementation or professional services.

• Technical leadership while remaining personally capable of building and diagnosing systems.

Experience in SaaS, fintech, investment management, governance technology, legal technology, document management or another sensitive-information environment would be valuable.

Practical knowledge of OWASP risks, secure authentication, API and token security, permissions, validation, rate limiting, secrets management, file-upload security, vulnerability management, incident response and privacy by design is essential.

QUALIFICATIONS

A relevant technology degree or diploma, or equivalent substantial professional experience, is preferred. Cloud, security or DevSecOps certifications are advantageous but do not replace proven production experience.

VALUES AND CHARACTER

CCMC is building a business grounded in integrity, responsible stewardship, service, humility, accountability and respect for human dignity.

Technical ability alone will not be sufficient. The successful candidate must demonstrate:

• Honesty and integrity.

• Responsible stewardship of customer information, company resources and intellectual property.

• Accountability for decisions, mistakes and outcomes.

• A service-oriented approach to customers and colleagues.

• Humility and willingness to receive constructive challenge.

• Respect for the dignity, background and beliefs of others.

• Confidentiality, fairness and sound judgment.

• A commitment to doing what is right, even when inconvenient.

• A long-term perspective that places trust ahead of shortcuts.

CCMC’s approach is informed by principles of stewardship, integrity, service and accountability. Employees are not required to hold a particular religious belief, but everyone is expected to uphold these professional values.

CCMC welcomes suitably qualified candidates from all backgrounds. Appointments will be based on competence, experience, character, alignment with these workplace values and the inherent requirements of the role.

PERSONAL ATTRIBUTES

The right person will be hands-on, rigorous, security conscious, commercially aware and comfortable working directly with a founder. They must take ownership, protect confidential information, remain calm during incidents and communicate effectively with technical and non-technical stakeholders.

This is not a purely managerial, junior development, website-design, prompt-writing, general IT-support or customer-service position.

WHY JOIN CCMC?

The foundational platform exists. You will influence the product, architecture and technical standards, work directly with the founder and help build reusable institutional infrastructure for Africa. The role can grow with CCMC and Portivue.

LOCATION

Hybrid, with preference for candidates based in Pretoria or Johannesburg, Gauteng. Attendance at client implementations and technical meetings may occasionally be required.

EMPLOYMENT AND REMUNERATION

The appointment structure and remuneration will be discussed with shortlisted candidates and will reflect experience, technical depth and production responsibility.

HOW TO APPLY

Email ***email_hidden*** with:

• A concise CV.

• A short explanation of why the role fits your experience.

• Examples of production applications for which you held technical responsibility.

• A description of your role in securing and operating those applications.

• Relevant qualifications or certifications.

• Your location, availability and remuneration expectations.

Working environment and technical requirements

The successful candidate must have:

• Reliable high-speed internet suitable for development, video meetings and secure remote access.
• A professional and secure home-working environment.
• Reliable backup connectivity, such as mobile data, for essential work during internet interruptions.
• Reasonable backup power sufficient to maintain connectivity and continue essential work during short power interruptions.
• A suitable modern computer for the recruitment assessment and initial onboarding period.

For ongoing production work, the successful candidate will be required to use a CCMC-approved and appropriately secured device. The final hardware arrangement will be agreed as part of the appointment and must comply with CCMC’s information-security requirements.

Where possible, include links to relevant work or case studies. Do not disclose confidential information.

Shortlisted candidates should expect a founder discussion, technical interview, proportionate non-production assessment and reference verification. The assessment will not be used as unpaid production work.

• CCMC will use candidate information only for legitimate recruitment purposes.

https://ccmc.africa