Division: Group Information Security & Control

Department/Unit: IT & Digital Banking Control

Job Objectives

• Ensure early detection and prevention of security risks and vulnerabilities within critical IT resources in the Bank.
• Provide Control Counseling, Advisory, and Decision Support Services, including risk-based performance management on emerging threats to the Bank's activities.
• Create and improve a homogeneous Information Security culture across all functions that aligns with the Bank's control and business objectives.
• Foster regulatory compliance of IT infrastructures and the adoption of global best practices without undue exposure to known vulnerabilities.
• Build and maintain strong working relationships.

Duties & Responsibilities

• Ensure compliance with policies, procedures, and regulatory requirements.
• Build a strong KYC compliance environment within ICT, Business Software Support, E-Business, and Channels Support functions.
• Ensure strict compliance with the Bank's logical access controls and Information Security policies in the day-to-day activities of all users.
• Ensure all outsourced IT user functions are executed in accordance with Service Level Agreements (SLAs) and the Bank's Information Security policies.
• Ensure users of all critical and vital banking applications are effectively reviewed and monitored.
• Ensure prompt resolution of all outstanding issues in Audit Reports, Management Letters, Regulatory Examiners' Reports, and other statutory examination reports relating to IT and systems.
• Conduct comprehensive risk assessments covering the design, implementation, and operation of all the Bank's E-Channels products to identify, assess, and recommend appropriate controls for key risks.
• Perform periodic technical security assessments of all E-Channels platforms, applications, and databases.
• Participate in User Acceptance Testing (UAT) for new E-Channels, collection platforms, and enhancements to existing products.
• Review all automated income lines as assigned by the Head of Internal Control.
• Ensure prompt and high-quality submission of assessment and compliance reports to the Head of Internal Control, including monthly and ad hoc reports.

Key Performance Indicators (KPIs)

• Zero tolerance for operational and fraud losses.
• Number of undetected regulatory and statutory infractions.
• Number of undetected internal policy and procedure infractions.
• Quality and timeliness of reporting losses and loss events in processing areas.
• Magnitude of IT-related regulatory sanctions.
• Audit rating of Logical Access Controls and Information Security Quality Assurance.
• Integrity of the logical access database.
• Promptness, accuracy, and validity of exception reporting and activity reports.
• Exceptions identified during peer reviews, control adequacy checks, and other Information Security and Quality Assurance reviews.
• Gap between prescribed turnaround time (TAT) and actual service delivery.

Job Requirements

Education

Minimum of a First Degree or equivalent in Business Information Systems, Computer Science, or Computer Engineering.

Certifications

The following certifications are an added advantage:

• CISA
• CISSP
• CRISC
• ISO 27001
• Cisco
• ITIL
• PCI DSS

Experience

One to two (1-2) years of relevant experience.

Key Competency Requirements

Knowledge

• Basic and intermediate banking operations.
• IT fraud and operational risk.
• Systems security policies, statutes, and regulatory interpretation/implementation.
• Revenue assurance and product knowledge.
• Detailed working knowledge of Microsoft Word, Excel, PowerPoint, intranet mailing facilities, and the Bank's core and ancillary banking applications.

Skills & Competencies

• Analytical and investigation skills.
• Auditing skills.
• Basic and intermediate banking operations skills.
• Computer Assisted Audit Techniques (CAAT).
• Information System Control.
• Information System Audit.
• Oral and written communication skills.
• Tactical skills.

Reporting Relationships

Functionally reports to:

Head, Internal Control

• Ensure compliance with policies, procedures, and regulatory requirements.
• Build a strong KYC compliance environment within ICT, Business Software Support, E-Business, and Channels Support functions.
• Ensure strict compliance with the Bank's logical access controls and Information Security policies in the day-to-day activities of all users.
• Ensure all outsourced IT user functions are executed in accordance with Service Level Agreements (SLAs) and the Bank's Information Security policies.
• Ensure users of all critical and vital banking applications are effectively reviewed and monitored.
• Ensure prompt resolution of all outstanding issues in Audit Reports, Management Letters, Regulatory Examiners' Reports, and other statutory examination reports relating to IT and systems.
• Conduct comprehensive risk assessments covering the design, implementation, and operation of all the Bank's E-Channels products to identify, assess, and recommend appropriate controls for key risks.
• Perform periodic technical security assessments of all E-Channels platforms, applications, and databases.
• Participate in User Acceptance Testing (UAT) for new E-Channels, collection platforms, and enhancements to existing products.
• Review all automated income lines as assigned by the Head of Internal Control.
• Ensure prompt and high-quality submission of assessment and compliance reports to the Head of Internal Control, including monthly and ad hoc reports.

• Analytical and investigation skills.
• Auditing skills.
• Basic and intermediate banking operations skills.
• Computer Assisted Audit Techniques (CAAT).
• Information System Control.
• Information System Audit.
• Oral and written communication skills.
• Tactical skills.

• Minimum of a First Degree or equivalent in Business Information Systems, Computer Science, or Computer Engineering.
• CISA (added advantage)
• CISSP (added advantage)
• CRISC (added advantage)
• ISO 27001 (added advantage)
• Cisco (added advantage)
• ITIL (added advantage)
• PCI DSS (added advantage)