Job Purpose

Responsible for providing strategic leadership, governance, and oversight of the Bank’s Technology Risk Management, IT Controls Assurance, Technology Audit Coordination, Vulnerability & Patch Management, Regulatory Compliance, and Technology Risk Reporting functions.

The role ensures that ICT risks are proactively identified, assessed, mitigated, monitored, and reported in alignment with the Bank’s risk appetite, regulatory requirements, cybersecurity frameworks, and industry best practices. The position acts as the central coordination point between ICT, Risk Management, Internal Audit, Compliance, Cybersecurity, Regulators, and External Auditors to ensure effective technology governance, control effectiveness, and continuous improvement of the Bank’s technology risk posture

Principle Responsibilities

• Provide strategic leadership and direction for Technology Risk & Compliance activities across the Bank.
• Develop and maintain an enterprise-wide Technology Risk Management framework and establish and monitor technology risk governance structures, policies, procedures, standards, and controls.
• Ensure Technology Risk and Compliance practices align with Bank strategy, regulatory requirements, and industry standards.
• Lead annual planning, budgeting, and performance management of the Technology Risk & Compliance function, set SMART objectives, and conduct performance evaluations for direct reports.
• Oversee identification, assessment, monitoring, and reporting of ICT risks, ensure maintenance and accuracy of the Technology Risk Register, and lead Risk and Control Self-Assessments (RCSA) across ICT functions.
• Monitor technology-related risk trends, KRIs, incidents, and emerging threats, and ensure risk mitigation plans are developed, implemented, and tracked to closure.
• Provide independent challenges and assurance regarding effectiveness of technology risk controls, establish and manage the Technology Controls Assurance Program, and ensure design and operating effectiveness testing of key technology controls.
• Oversee control reviews relating to infrastructure, applications, cloud services, cybersecurity, data protection, and third-party technology services, and monitor remediation of identified control weaknesses and track progress to closure.
• Lead all ICT-related internal audits, external audits, regulatory examinations, and compliance reviews, coordinate responses to audit observations, regulatory findings, and management action plans, and monitor closure of audit and regulatory issues within agreed timelines.
• Serve as primary liaison with BOT, Internal Audit, External Auditors, Risk Management, and Compliance functions on technology risk matters, and build strong relationships with internal and external stakeholders.
• Provide governance oversight over vulnerability assessment and remediation activities, ensure vulnerability remediation and patch management processes operate effectively and within agreed SLAs, and review vulnerability management performance, KPIs, risks, and remediation effectiveness.
• Escalate critical vulnerabilities and cyber risks to management, and ensure emerging cyber threats and zero-day vulnerabilities are appropriately managed.
• Ensure ongoing compliance with Bank of Tanzania regulations, Personal Data Protection requirements, ISO 27001, PCI-DSS, COBIT, ITIL, Internal policies and standards, and oversee periodic review and maintenance of ICT policies, standards, procedures, and frameworks.
• Drive compliance monitoring and reporting activities, prepare executive dashboards and reports covering Technology risks, Controls effectiveness, Audit status, Regulatory compliance, Vulnerability management, and Key Risk Indicators (KRIs), and present technology risk matters to ICT Management, Risk Committees, Executive Management, and Board Committees.

Qualifications Required

• Bachelor’s degree in computer science, Information Systems, Cybersecurity, Information Technology, or related fields.
• At least 8 years of experience in ICT Risk, Technology Governance, Cybersecurity, Audit, Compliance, or related fields, including at least 4 years in a managerial or leadership role with demonstrated responsibility for leading teams and driving strategic initiatives.
• Master’s degree in technology, Risk Management, Cybersecurity, Business Administration, or related field will be an added advantage.
• At least one of the related professional certifications (COBIT, ITIL, CGEIT, CRISC, CISA, ISO27001 LA/LI, PCI DSS).
• Proven experience in banking, financial services, or other highly regulated environments, with demonstrated expertise in managing technology risk frameworks, governance processes, and compliance programs.
• Experience working with regulators, auditors, and executive management.
• Technology governance frameworks and recognized practices such as COBIT, ISO 31000, ISO 27001, ITIL, NIST, and PCI DSS.
• Third-party technology risk management and vendor due-diligence practices.
• Regulatory compliance, data privacy, cyber and technology-related requirements applicable to the banking sector.
• Experience in policy framework design, control mapping, and risk register management using GRC tools.
• Proficiency in third-party risk assessment and ongoing supplier risk monitoring to support effective risk governance.
• Expertise in data visualization for executive reporting and dashboard development, combined with strong audit and compliance management capabilities.

• Provide strategic leadership and direction for Technology Risk & Compliance activities across the Bank.
• Develop and maintain an enterprise-wide Technology Risk Management framework and establish and monitor technology risk governance structures, policies, procedures, standards, and controls.
• Ensure Technology Risk and Compliance practices align with Bank strategy, regulatory requirements, and industry standards.
• Lead annual planning, budgeting, and performance management of the Technology Risk & Compliance function, set SMART objectives, and conduct performance evaluations for direct reports.
• Oversee identification, assessment, monitoring, and reporting of ICT risks, ensure maintenance and accuracy of the Technology Risk Register, and lead Risk and Control Self-Assessments (RCSA) across ICT functions.
• Monitor technology-related risk trends, KRIs, incidents, and emerging threats, and ensure risk mitigation plans are developed, implemented, and tracked to closure.
• Provide independent challenges and assurance regarding effectiveness of technology risk controls, establish and manage the Technology Controls Assurance Program, and ensure design and operating effectiveness testing of key technology controls.
• Oversee control reviews relating to infrastructure, applications, cloud services, cybersecurity, data protection, and third-party technology services, and monitor remediation of identified control weaknesses and track progress to closure.
• Lead all ICT-related internal audits, external audits, regulatory examinations, and compliance reviews, coordinate responses to audit observations, regulatory findings, and management action plans, and monitor closure of audit and regulatory issues within agreed timelines.
• Serve as primary liaison with BOT, Internal Audit, External Auditors, Risk Management, and Compliance functions on technology risk matters, and build strong relationships with internal and external stakeholders.
• Provide governance oversight over vulnerability assessment and remediation activities, ensure vulnerability remediation and patch management processes operate effectively and within agreed SLAs, and review vulnerability management performance, KPIs, risks, and remediation effectiveness.
• Escalate critical vulnerabilities and cyber risks to management, and ensure emerging cyber threats and zero-day vulnerabilities are appropriately managed.
• Ensure ongoing compliance with Bank of Tanzania regulations, Personal Data Protection requirements, ISO 27001, PCI-DSS, COBIT, ITIL, Internal policies and standards, and oversee periodic review and maintenance of ICT policies, standards, procedures, and frameworks.
• Drive compliance monitoring and reporting activities, prepare executive dashboards and reports covering Technology risks, Controls effectiveness, Audit status, Regulatory compliance, Vulnerability management, and Key Risk Indicators (KRIs), and present technology risk matters to ICT Management, Risk Committees, Executive Management, and Board Committees.

• Technology governance frameworks and recognized practices such as COBIT, ISO 31000, ISO 27001, ITIL, NIST, and PCI DSS.
• Third-party technology risk management and vendor due-diligence practices.
• Regulatory compliance, data privacy, cyber and technology-related requirements applicable to the banking sector.
• Experience in policy framework design, control mapping, and risk register management using GRC tools.
• Proficiency in third-party risk assessment and ongoing supplier risk monitoring to support effective risk governance.
• Expertise in data visualization for executive reporting and dashboard development, combined with strong audit and compliance management capabilities.

• Bachelor’s degree in computer science, Information Systems, Cybersecurity, Information Technology, or related fields.
• At least 8 years of experience in ICT Risk, Technology Governance, Cybersecurity, Audit, Compliance, or related fields, including at least 4 years in a managerial or leadership role with demonstrated responsibility for leading teams and driving strategic initiatives.
• Master’s degree in technology, Risk Management, Cybersecurity, Business Administration, or related field will be an added advantage.
• At least one of the related professional certifications (COBIT, ITIL, CGEIT, CRISC, CISA, ISO27001 LA/LI, PCI DSS).
• Proven experience in banking, financial services, or other highly regulated environments, with demonstrated expertise in managing technology risk frameworks, governance processes, and compliance programs.
• Experience working with regulators, auditors, and executive management.