CRDB Bank PLC – Benki ya CRDB is hiring for the position of Senior Manager Cyber Governance, Risk & Compliance in Tanzania Head Office. The closing date for applications is 24 November 2026.

Job purpose

Responsible for providing strategic leadership and oversight of the Bank’s cybersecurity governance, risk management, regulatory compliance, assurance, cybersecurity strategy, performance management and reporting. The role establishes the governance framework through which cybersecurity policies, accountability, risk appetite, regulatory requirements, control expectations and management oversight are defined and maintained across the Bank and its subsidiaries.

Provide leadership over the identification, assessment, treatment, monitoring and reporting of cybersecurity risks and provides management with appropriate assurance over the effectiveness of the Bank’s cybersecurity control environment and compliance with applicable regulatory, legal and industry requirements.

Oversee the Bank’s cybersecurity governance and awareness programme, ensuring that cybersecurity policies, standards, management expectations and security culture remain aligned with the Bank’s business objectives, risk profile and regulatory environment.

Support the Head of Cybersecurity in translating the Bank’s cybersecurity vision into an actionable strategy and roadmap, and provides consolidated visibility of cybersecurity performance, risk, compliance, maturity, strategic initiatives and investment through appropriate management, executive and Board reporting.

Principal responsibilities

• Develop and monitor execution of the Cybersecurity strategy, operating model, roadmap and annual priorities in alignment with the overall corporate strategy and the Bank’s business and risk objectives.
• Support the Head of Cybersecurity in translating the Bank’s cybersecurity vision into an actionable strategy, strategic roadmap, annual priorities and measurable outcomes.
• Provide strategic leadership and direction to Cybersecurity Governance, Cybersecurity Risk & Assurance, and Cybersecurity Strategy & Reporting, ensuring clear accountabilities and effective coordination across the function.
• Establish and maintain an effective cybersecurity governance framework defining appropriate accountability, oversight, decision-making, escalation and reporting arrangements.
• Provide authoritative advice to the Head of Cybersecurity and senior management on material cyber risks, regulatory developments, governance matters, control weaknesses and other issues requiring management attention.
• Provide oversight of the Bank’s cybersecurity policy and standards framework, ensuring it remains current, risk-based, enforceable and aligned with applicable regulatory and business requirements.
• Maintain senior management oversight of material cybersecurity policy exceptions, control deviations and significant non-compliance, ensuring appropriate risk acceptance and escalation.
• Ensure the Bank maintains an effective governance structure for cybersecurity decisions, management oversight and accountability across the Bank and relevant subsidiaries.
• Support the establishment and monitoring of cybersecurity risk appetite, tolerance levels and Key Risk Indicators (KRIs), ensuring material exposures outside approved thresholds receive appropriate management attention.
• Ensure accountable risk owners establish effective treatment plans for material cyber risks and that significant overdue or inadequate remediation is appropriately challenged and escalated.
• Establish and oversee a risk-based cybersecurity assurance programme that provides management with confidence regarding the adequacy and effectiveness of key cybersecurity controls.
• Provide strategic coordination and oversight of cybersecurity-related internal audits, external audits, regulatory reviews and independent assessments.
• Provide strategic oversight of the Bank’s cybersecurity regulatory and compliance obligations, ensuring applicable requirements are identified, understood and incorporated into cybersecurity governance and control arrangements.
• Maintain management oversight of compliance with applicable regulatory requirements and cybersecurity frameworks, including ISO/IEC 27001, PCI DSS and other requirements adopted by or applicable to the Bank.
• Maintain oversight of cybersecurity programmes and initiatives, ensuring progress, strategic dependencies, delivery risks and material constraints are visible to cybersecurity management.
• Establish an integrated cybersecurity performance framework incorporating appropriate KPIs, KRIs, maturity measures and other indicators necessary to assess performance and risk.
• Ensure high-quality, accurate and decision-oriented cybersecurity reporting is provided to senior management, Executive Management, Board committees and other relevant governance forums.
• Ensure appropriate awareness and training requirements are established for employees, management, privileged users and other relevant stakeholders according to their responsibilities and risk exposure, and monitor the effectiveness of cybersecurity awareness and behavioral-risk initiatives through meaningful performance measures, trends, security events and simulation outcomes.
• Ensure material third-party cybersecurity exposures and unacceptable control gaps are escalated to accountable risk owners and appropriate management forums.
• Establish appropriate Group-level cybersecurity governance, risk, compliance and reporting expectations for subsidiaries while taking account of applicable local regulatory requirements.
• Support the Head of Cybersecurity in the development and prioritization of the cybersecurity budget, ensuring investment is aligned with material risks, regulatory requirements, strategic priorities and capability needs.
• Monitor cybersecurity strategic investment and budget performance and escalate significant constraints or variances affecting delivery of cybersecurity priorities.
• Lead, coach and develop the Cybersecurity Governance, Risk & Compliance team, establishing clear accountability, performance expectations, professional-development priorities and succession arrangements.
• Represent Cybersecurity GRC in relevant management, risk, audit, regulatory and governance forums and provide constructive challenge on material cybersecurity risks and control matters.

Qualification required

• Bachelor’s degree in Cybersecurity, Information Security, Information Technology, Computer Science, Information Systems, Risk Management, Audit, Computer/Telecommunications Engineering, Business Information Systems or another relevant field.
• Minimum of seven years’ relevant experience in Cybersecurity Governance, Information Security Risk Management, Cybersecurity Compliance, Security Assurance, Technology Risk, IT Audit, Information Security Management or related cybersecurity disciplines.
• At least three years’ experience in a managerial, supervisory or senior leadership role within cybersecurity governance, risk, compliance, audit or assurance.
• Demonstrated experience developing or overseeing cybersecurity governance and risk-management frameworks in a complex organization.
• Experience coordinating cybersecurity internal audits, external assessments, regulatory reviews, and remediation programmes, with banking or financial services experience strongly preferred.
• Relevant professional certifications such as CISSP, CISA, CRISC, CGEIT, CCISO, ISO27001 LI/LA, COBIT Foundations and PCI DSS certifications.
• Demonstrated experience managing material cybersecurity risks, control deficiencies, audit issues and regulatory compliance obligations.
• Demonstrated experience with recognized cybersecurity standards and compliance frameworks such as ISO/IEC 27001, NIST CSF and PCI DSS.
• Experience developing cybersecurity strategy, management reporting, KPIs, KRIs or cybersecurity maturity programmes.
• Experience advising senior management on cybersecurity risks, regulatory matters, control effectiveness and strategic priorities.
• Experience managing or overseeing third-party cybersecurity risk and security-governance requirements.
• Experience supporting cybersecurity governance across subsidiaries, multiple legal entities or regional operations will be an added advantage.

Footer

CRDB Bank is dedicated to upholding Sustainability and ESG practices and encourage applicants who share this commitment. The Bank also promotes an inclusive workplace, hence applications from women and individual with disabilities are encouraged.

It is important to note that CRDB Bank does not charge any fees for the application or recruitment process, and any requests for payment should be disregarded as they do not represent the bank’s practices.

Only Shortlisted Candidates will be Contacted.

• Develop and monitor execution of the Cybersecurity strategy, operating model, roadmap and annual priorities in alignment with the overall corporate strategy and the Bank’s business and risk objectives.
• Support the Head of Cybersecurity in translating the Bank’s cybersecurity vision into an actionable strategy, strategic roadmap, annual priorities and measurable outcomes.
• Provide strategic leadership and direction to Cybersecurity Governance, Cybersecurity Risk & Assurance, and Cybersecurity Strategy & Reporting, ensuring clear accountabilities and effective coordination across the function.
• Establish and maintain an effective cybersecurity governance framework defining appropriate accountability, oversight, decision-making, escalation and reporting arrangements.
• Provide authoritative advice to the Head of Cybersecurity and senior management on material cyber risks, regulatory developments, governance matters, control weaknesses and other issues requiring management attention.
• Provide oversight of the Bank’s cybersecurity policy and standards framework, ensuring it remains current, risk-based, enforceable and aligned with applicable regulatory and business requirements.
• Maintain senior management oversight of material cybersecurity policy exceptions, control deviations and significant non-compliance, ensuring appropriate risk acceptance and escalation.
• Ensure the Bank maintains an effective governance structure for cybersecurity decisions, management oversight and accountability across the Bank and relevant subsidiaries.
• Support the establishment and monitoring of cybersecurity risk appetite, tolerance levels and Key Risk Indicators (KRIs), ensuring material exposures outside approved thresholds receive appropriate management attention.
• Ensure accountable risk owners establish effective treatment plans for material cyber risks and that significant overdue or inadequate remediation is appropriately challenged and escalated.
• Establish and oversee a risk-based cybersecurity assurance programme that provides management with confidence regarding the adequacy and effectiveness of key cybersecurity controls.
• Provide strategic coordination and oversight of cybersecurity-related internal audits, external audits, regulatory reviews and independent assessments.
• Provide strategic oversight of the Bank’s cybersecurity regulatory and compliance obligations, ensuring applicable requirements are identified, understood and incorporated into cybersecurity governance and control arrangements.
• Maintain management oversight of compliance with applicable regulatory requirements and cybersecurity frameworks, including ISO/IEC 27001, PCI DSS and other requirements adopted by or applicable to the Bank.
• Maintain oversight of cybersecurity programmes and initiatives, ensuring progress, strategic dependencies, delivery risks and material constraints are visible to cybersecurity management.
• Establish an integrated cybersecurity performance framework incorporating appropriate KPIs, KRIs, maturity measures and other indicators necessary to assess performance and risk.
• Ensure high-quality, accurate and decision-oriented cybersecurity reporting is provided to senior management, Executive Management, Board committees and other relevant governance forums.
• Ensure appropriate awareness and training requirements are established for employees, management, privileged users and other relevant stakeholders according to their responsibilities and risk exposure, and monitor the effectiveness of cybersecurity awareness and behavioral-risk initiatives through meaningful performance measures, trends, security events and simulation outcomes.
• Ensure material third-party cybersecurity exposures and unacceptable control gaps are escalated to accountable risk owners and appropriate management forums.
• Establish appropriate Group-level cybersecurity governance, risk, compliance and reporting expectations for subsidiaries while taking account of applicable local regulatory requirements.
• Support the Head of Cybersecurity in the development and prioritization of the cybersecurity budget, ensuring investment is aligned with material risks, regulatory requirements, strategic priorities and capability needs.
• Monitor cybersecurity strategic investment and budget performance and escalate significant constraints or variances affecting delivery of cybersecurity priorities.
• Lead, coach and develop the Cybersecurity Governance, Risk & Compliance team, establishing clear accountability, performance expectations, professional-development priorities and succession arrangements.
• Represent Cybersecurity GRC in relevant management, risk, audit, regulatory and governance forums and provide constructive challenge on material cybersecurity risks and control matters.

• Cybersecurity governance
• Information security risk management
• Cybersecurity compliance
• Security assurance
• Technology risk
• IT audit
• Information security management
• Developing or overseeing cybersecurity governance and risk-management frameworks
• Coordinating cybersecurity internal audits, external assessments, regulatory reviews, and remediation programmes
• Managing material cybersecurity risks
• Managing control deficiencies
• Managing audit issues
• Managing regulatory compliance obligations
• Developing cybersecurity strategy
• Management reporting
• KPIs
• KRIs
• Cybersecurity maturity programmes
• Advising senior management on cybersecurity risks
• Advising senior management on regulatory matters
• Advising senior management on control effectiveness
• Advising senior management on strategic priorities
• Managing or overseeing third-party cybersecurity risk
• Managing or overseeing security-governance requirements
• Supporting cybersecurity governance across subsidiaries
• Supporting cybersecurity governance across multiple legal entities
• Supporting cybersecurity governance across regional operations

• Bachelor’s degree in Cybersecurity, Information Security, Information Technology, Computer Science, Information Systems, Risk Management, Audit, Computer/Telecommunications Engineering, Business Information Systems or another relevant field.
• Minimum of seven years’ relevant experience in Cybersecurity Governance, Information Security Risk Management, Cybersecurity Compliance, Security Assurance, Technology Risk, IT Audit, Information Security Management or related cybersecurity disciplines.
• At least three years’ experience in a managerial, supervisory or senior leadership role within cybersecurity governance, risk, compliance, audit or assurance.
• Demonstrated experience developing or overseeing cybersecurity governance and risk-management frameworks in a complex organization.
• Experience coordinating cybersecurity internal audits, external assessments, regulatory reviews, and remediation programmes, with banking or financial services experience strongly preferred.
• Relevant professional certifications such as CISSP, CISA, CRISC, CGEIT, CCISO, ISO27001 LI/LA, COBIT Foundations and PCI DSS certifications.
• Demonstrated experience managing material cybersecurity risks, control deficiencies, audit issues and regulatory compliance obligations.
• Demonstrated experience with recognized cybersecurity standards and compliance frameworks such as ISO/IEC 27001, NIST CSF and PCI DSS.
• Experience developing cybersecurity strategy, management reporting, KPIs, KRIs or cybersecurity maturity programmes.
• Experience advising senior management on cybersecurity risks, regulatory matters, control effectiveness and strategic priorities.
• Experience managing or overseeing third-party cybersecurity risk and security-governance requirements.
• Experience supporting cybersecurity governance across subsidiaries, multiple legal entities or regional operations will be an added advantage.