Job purpose

Responsible for embedding Secure and Privacy by Design principles into technology projects, system development and solution delivery across the Bank. The role assesses security and privacy risks in proposed and existing solutions and ensures appropriate requirements are addressed before implementation.

Principal responsibilities

• Embed Secure and Privacy by Design requirements into the Bank’s SDLC, project and technology-delivery processes.
• Conduct Baseline Security Requirements (BSRs) assessments for new and existing systems.
• Conduct threat and Privacy Impact Assessments for applicable systems, projects and technology initiatives.
• Review solution architectures and data flows to confirm appropriate security and privacy controls are incorporated from design stage.
• Assess cloud solution designs and data-protection controls against approved security requirements.
• Define security and privacy requirements that solutions must satisfy before progressing through relevant project or development stages.
• Advise project teams, developers and solution owners on practical security and privacy improvements.
• Support interpretation of applicable privacy and data-protection requirements from a cybersecurity perspective.
• Document identified security and privacy risks and follow up to ensure material issues are appropriately resolved or escalated.
• Verify that agreed security requirements are addressed before security approval, clearance or recommendation.
• Perform other related responsibilities assigned by Management.

Qualification required

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Software Engineering, Computer Engineering or related field.
• Minimum 3 years relevant experience in cybersecurity architecture, application security, security assessment, privacy or secure development.
• Relevant certifications such as CISSP, CCSP, CSSLP, CISM, ISO 27001 or cloud-security certifications.
• Experience supporting technology projects, architecture reviews or system security assessments.
• Knowledge of Secure and Privacy by Design principles.
• Knowledge of Secure SDLC and DevSecOps concepts.
• Knowledge of Security and Privacy Impact Assessments.
• Knowledge of Threat modelling and system security assessment.
• Knowledge of Application, API and cloud security principles.
• Knowledge of Data protection and privacy requirements.
• Knowledge of ISO 27001, NIST, PCI DSS, OWASP and relevant security standards.

CRDB Bank is dedicated to upholding Sustainability and ESG practices and encourage applicants who share this commitment. The Bank also promotes an inclusive workplace, hence applications from women and individual with disabilities are encouraged.

It is important to note that CRDB Bank does not charge any fees for the application or recruitment process, and any requests for payment should be disregarded as they do not represent the bank’s practices.

Only Shortlisted Candidates will be Contacted.

• Embed Secure and Privacy by Design requirements into the Bank’s SDLC, project and technology-delivery processes.
• Conduct Baseline Security Requirements (BSRs) assessments for new and existing systems.
• Conduct threat and Privacy Impact Assessments for applicable systems, projects and technology initiatives.
• Review solution architectures and data flows to confirm appropriate security and privacy controls are incorporated from design stage.
• Assess cloud solution designs and data-protection controls against approved security requirements.
• Define security and privacy requirements that solutions must satisfy before progressing through relevant project or development stages.
• Advise project teams, developers and solution owners on practical security and privacy improvements.
• Support interpretation of applicable privacy and data-protection requirements from a cybersecurity perspective.
• Document identified security and privacy risks and follow up to ensure material issues are appropriately resolved or escalated.
• Verify that agreed security requirements are addressed before security approval, clearance or recommendation.
• Perform other related responsibilities assigned by Management.

• Secure and Privacy by Design principles
• Secure SDLC and DevSecOps concepts
• Security and Privacy Impact Assessments
• Threat modelling and system security assessment
• Application, API and cloud security principles
• Data protection and privacy requirements
• ISO 27001, NIST, PCI DSS, OWASP and relevant security standards

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Software Engineering, Computer Engineering or related field.
• Minimum 3 years relevant experience in cybersecurity architecture, application security, security assessment, privacy or secure development.
• Relevant certifications such as CISSP, CCSP, CSSLP, CISM, ISO 27001 or cloud-security certifications.
• Experience supporting technology projects, architecture reviews or system security assessments.