Officer, Digital Financial Services & Project Risks

About the role

The Officer will provide independent second‑line assurance on Sidian Bank’s Digital Financial Services (DFS) controls and project risks. The role ensures that digital channels, lending platforms, merchant acquiring and data‑lake pipelines operate in compliance with internal policies, CBK and data‑protection regulations.

Key responsibilities

• Maintain 2nd‑line governance oversight for all DFS operations, ensuring compliance with CBK, ODPC and Kenya Data Protection Act requirements.
• Coordinate risk and data‑impact assessments with the ERM and IT Risk Officer, reviewing technical vulnerabilities, API security, privileged access management and control baselines for new features and third‑party integrations.
• Oversee business continuity and disaster‑recovery readiness for critical digital channels, participating in BCP/DR tests and validating recovery objectives.
• Monitor digital lending and merchant acquiring controls, develop risk metrics, perform independent control testing and track remediation of technical gaps.
• Review incidents, support investigations of digital transaction failures or privacy breaches, and ensure timely remediation by first‑line teams.
• Prepare and present key risk indicator dashboards and risk performance reports for senior management and the board.

Required profile

• Bachelor’s degree in IT, Computer Science, Business or related field.
• At least 5 years of banking or IT experience with exposure to digital financial services and projects.
• Strong knowledge of information security frameworks such as ISO 27001, NIST 800‑53 and relevant data‑protection regulations.
• Professional certifications like CISA, CISM, CISSP, CompTIA Security+ or CEH are preferred.

Required skills

• IT risk assessment, vulnerability assessment, API security, privileged access management.
• Business continuity planning, disaster‑recovery coordination.
• Digital lending control monitoring, merchant acquiring control review.
• Knowledge of CBK guidelines, ODPC requirements and Kenya Data Protection Act 2019.
• Experience with security frameworks (ISO 27001, NIST 800‑53) and certifications (CISA, CISM, CISSP, CEH, CompTIA Security+).