ICT Risk Officer

About the role

GA Insurance Limited is hiring a permanent ICT Risk Officer in its Risk & Compliance department in Nairobi, reporting to the General Manager Risk & Compliance. The role identifies, assesses, monitors and reports ICT and technology risks across the organisation, providing independent oversight so that risks are managed in line with the organisation's risk appetite, regulatory requirements and business objectives.

Key responsibilities

• Develop and maintain the ICT risk management framework and the ICT Risk Register, and conduct risk assessments across systems, projects, infrastructure and third-party providers.
• Assess emerging technology risks such as cloud, digital transformation, AI and cyber risks.
• Monitor Key Risk Indicators (KRIs) and prepare monthly, quarterly and annual ICT risk reports, escalating significant risks to management and tracking mitigation actions.
• Monitor the security posture and controls, investigate and manage security incidents, review vulnerability assessments and monitor tools such as SIEM, EDR, DLP, firewalls and endpoint security.
• Ensure compliance with technology risk regulations, support risk reviews of new systems and projects, take part in business continuity and disaster recovery assessments, and support internal and external ICT risk audits.
• Assess vendor and service provider technology risks, review ICT-related contractual and control requirements, and monitor outsourced technology services.
• Promote risk awareness across ICT and business functions and guide risk assessments and control effectiveness.

Required profile

• Bachelor's degree in Information Technology, Computer Science, Information Systems, Risk Management or a related field.
• Over 3 years' experience in ICT Risk, Technology Audit, IT Governance or Enterprise Risk Management; experience in regulated industries is desirable.
• Professional certification such as CRISC, CISA, CGEIT, ISO 31000 Risk Management or CISSP.

Required skills

• Risk assessment and analysis
• Governance and regulatory compliance
• Technology risk management
• Report writing and communication
• Stakeholder management

Candidates apply by sending their application letter and updated CV to the company's careers email, indicating the position in the subject line; only shortlisted candidates will be contacted.