ICT Risk Officer, Risk & Compliance

About the role

The ICT Risk Officer works within the Risk & Compliance department in Nairobi and reports to the General Manager Risk & Compliance. The role identifies, assesses, monitors and reports ICT and technology risks across the organisation, providing independent oversight so that risks are managed in line with the organisation's risk appetite, regulatory requirements and business objectives.

Key responsibilities

• Develop and maintain the ICT risk management framework and conduct risk assessments across systems, projects, infrastructure and third-party providers
• Maintain the ICT Risk Register, monitor risk treatment plans and assess emerging risks such as cloud, digital transformation, AI and cyber risks
• Monitor Key Risk Indicators (KRIs), prepare monthly, quarterly and annual ICT risk reports, escalate significant risks and track mitigation actions
• Monitor the security posture, investigate and manage security incidents, review vulnerability assessments and monitor tools such as SIEM, EDR, DLP, firewalls and endpoint security
• Ensure compliance with technology risk regulations, support risk reviews of new systems and projects, and take part in business continuity and disaster recovery assessments
• Assess vendor technology risks, review ICT-related contracts and controls, and monitor outsourced technology services
• Promote risk awareness across ICT and business functions and guide risk assessments and control effectiveness

Required profile

• Bachelor's degree in Information Technology, Computer Science, Information Systems, Risk Management or a related field
• Professional certification such as CRISC, CISA, CGEIT, ISO 31000 Risk Management or CISSP
• Over 3 years' experience in ICT Risk, Technology Audit, IT Governance or Enterprise Risk Management
• Experience in regulated industries is desirable

Required skills

• Risk assessment and analysis
• Governance and regulatory compliance
• Technology risk management
• Report writing and communication
• Stakeholder management

Applications are made by sending an application letter and updated CV by 6 November 2026, indicating the position in the subject line.