ICT Risk Officer

About the role

Kingdom Bank is hiring a full-time, on-site ICT Risk Officer in Nairobi. The role provides continuous independent assurance of the bank's information security, covering confidentiality, integrity and availability of its IT systems, and ensures ICT-related risks are managed in line with the bank's policies, laws, regulatory guidelines and applicable standards.

Key responsibilities

• Carry out ICT risk assessments of bank systems and recommend security controls to mitigate risks
• Continuously review and improve ICT controls and assess them across operating systems, applications, databases and networks
• Provide continuous assurance on ICT risks and evaluate controls for consistency with regulatory, standards and internal policy requirements
• Promote information security awareness through consultation, guidance and awareness programmes
• Anticipate threats and vulnerabilities and coordinate with the ICT department on mitigation measures
• Manage ICT risk registers and track closure of audit, regulatory, vulnerability assessment, penetration test and risk assessment findings
• Periodically run vulnerability assessments and penetration tests
• Monitor compliance with CBK ICT and cybersecurity guidelines and data protection requirements
• Assess risks from vendors, cloud services, fintech partners and system integrators, and from system changes and new technology deployments
• Coordinate ICT risk input into cybersecurity incident response and report lessons learned
• Review business continuity, disaster recovery, backup and restoration arrangements
• Review user access, privileged access, segregation of duties and identity lifecycle controls
• Prepare periodic ICT risk reports, dashboards and management updates
• Review cloud security, data protection, encryption, logging, monitoring and data loss prevention controls

Required profile

• Bachelor's degree in Information Technology, Information Security or Computer Science
• Relevant IT security professional qualifications such as CISA, CISM or CEH
• Minimum of 5 years' experience in a similar role in a highly computerized environment
• Experience implementing standards such as ISO 27001 and COBIT
• Experience in a banking IT function is an advantage

Required skills

• Knowledge of cybersecurity practices (IAM, data protection, penetration testing)
• Experience with Windows Enterprise servers or UNIX systems
• API review and mobile security knowledge is an added advantage

The application is handled through the recruiting agency that posted the vacancy.