Job Purpose Statement

Key Accountabilities (Duties and Responsibilities)

Internal business processes 75%

• Undertake risk assessments, analyse the effectiveness of technical and procedural control activities, and provide actionable recommendations to management.
• Assess the Bank’s information and Cyber Security capabilities, operations and supporting technology controls to identify risks and recommend pragmatic risk mitigation measures.
• Identify and assess business disruption risks and their impacts associated with current business practices and strategic plans.
• Identify critical points of failure in the Bank’s ICT disaster recovery plans and recommend risk mitigation measures based on best practice standards.
• Review and report on the residual ICT risks.
• Review and improve the training and awareness programs for Information and Cyber Security in the bank.
• Succinctly frame emerging threats and risk in alignment with the existing risk profile.
• Distil complex risk, process and control relationships into simple dashboards/reports.
• Demonstrate robust risk management oversight in supporting various internal assessments and regulatory examinations.
• Support the development of the IT risk management practice, framework and methodologies.
• Review, report and follow-up on closure of any noted gaps during the ICT risk assessments.
• Periodical review of the ICT and Cyber Security policy, standards and guidelines.

Customer 15%

• Drive customer satisfaction through timely ICT risk Assessments that have been put in place to support business.
• Proving prompt feedback on internal customer queries on ICT.

Learning and growth 10%

Responsible for delivering the performance objectives set and managing his/her own learning and development to build capacity and avail him/herself for coaching and training opportunities.

Job Specifications

• University Degree in a relevant field
• Master’s degree will be an added advantage
• Relevant certifications in Information Security and Risk Management knowledge areas such as CRISC, CISM, CISA, CISSP or equivalent.
• At least 4 years’ experience in a similar role with exposure to Banking operations, Technology or Assurance functions.
• Practical Knowledge of BOT guidelines on ICT Risk Management.
• Practical Knowledge of risk and control frameworks and their application within the Financial Services industry

• Undertake risk assessments, analyse the effectiveness of technical and procedural control activities, and provide actionable recommendations to management.
• Assess the Bank’s information and Cyber Security capabilities, operations and supporting technology controls to identify risks and recommend pragmatic risk mitigation measures.
• Identify and assess business disruption risks and their impacts associated with current business practices and strategic plans.
• Identify critical points of failure in the Bank’s ICT disaster recovery plans and recommend risk mitigation measures based on best practice standards.
• Review and report on the residual ICT risks.
• Review and improve the training and awareness programs for Information and Cyber Security in the bank.
• Succinctly frame emerging threats and risk in alignment with the existing risk profile.
• Distil complex risk, process and control relationships into simple dashboards/reports.
• Demonstrate robust risk management oversight in supporting various internal assessments and regulatory examinations.
• Support the development of the IT risk management practice, framework and methodologies.
• Review, report and follow-up on closure of any noted gaps during the ICT risk assessments.
• Periodical review of the ICT and Cyber Security policy, standards and guidelines.
• Drive customer satisfaction through timely ICT risk Assessments that have been put in place to support business.
• Proving prompt feedback on internal customer queries on ICT.
• Responsible for delivering the performance objectives set and managing his/her own learning and development to build capacity and avail him/herself for coaching and training opportunities.

• Risk assessment
• Information and Cyber Security
• Risk mitigation
• Business disruption risk assessment
• Disaster recovery planning
• Training and awareness programs
• Threat analysis
• Reporting and dashboarding
• Risk management oversight
• IT risk management framework development
• Policy review
• Customer satisfaction
• Problem-solving
• Learning and development

• University Degree in a relevant field
• Master’s degree will be an added advantage
• Relevant certifications in Information Security and Risk Management knowledge areas such as CRISC, CISM, CISA, CISSP or equivalent.
• Practical Knowledge of BOT guidelines on ICT Risk Management.
• Practical Knowledge of risk and control frameworks and their application within the Financial Services industry