Senior Officer - ICT Risk

About the role

Kingdom Bank is hiring a Senior Officer - ICT Risk in its Head Office in Westlands, Nairobi. Reporting to the Manager - ICT Risk, the officer provides continuous independent assurance of the bank's information security, covering confidentiality, integrity and availability of IT systems, and ensures ICT-related risks are managed in line with the bank's policies, laws, regulatory guidelines and applicable standards.

Key responsibilities

• Carry out ICT risk assessments of bank systems and recommend IT security controls to mitigate risks
• Review and improve ICT controls and systems (servers, applications, databases, network devices) and track closure of identified risks
• Evaluate ICT controls across operating systems, applications, database interfaces and networks for consistent compliance with regulatory, standards and internal policy requirements
• Promote information security awareness through consultation, guidance and awareness programmes
• Anticipate threats and vulnerabilities and coordinate with the ICT department on mitigation measures
• Manage ICT risk registers and validate remediation of audit, regulatory, vulnerability, penetration test and risk assessment findings
• Periodically run vulnerability assessments and penetration tests
• Monitor compliance with CBK ICT and cybersecurity guidelines, data protection requirements and other banking regulations
• Assess risks from vendors, cloud services, fintech partners and system integrators, and coordinate risk input into incident response
• Review business continuity, disaster recovery, backup and restoration arrangements
• Review user access, privileged access, segregation of duties and identity lifecycle controls
• Prepare periodic ICT risk reports, dashboards and management updates
• Assess risks from system changes, new technologies and infrastructure upgrades before production deployment
• Monitor third-party ICT risk and the effectiveness of security awareness initiatives
• Review cloud security, data protection, encryption, logging, monitoring and data loss prevention controls

Required profile

• Bachelor's degree in information technology, information security or computer science
• Relevant IT security professional qualifications such as CISA, CISM or CEH; API review and mobile security qualifications are an added advantage
• Minimum of 5 years' experience in a similar role in a highly computerised environment
• Experience implementing information security standards such as ISO 27001 and COBIT
• Experience in the IT function within a banking environment is an advantage

Required skills

• Understanding of ICT risk and systems security control processes
• Knowledge of information systems architecture and operational practices
• Appreciation of audit methodologies
• Good knowledge of cybersecurity practices (identity and access management, data protection, penetration testing)
• Experience with Windows Enterprise servers or UNIX systems