Responsible for identifying and assessing ICT risks, reviewing cybersecurity controls, monitoring system vulnerabilities, maintaining risk registers, and ensuring compliance with information security policies and data protection requirements. Requires a degree in Information Technology, Computer Science, or a related field. This is a full-time, on-site based in Nairobi.

The ICT Risk Officer, will provide continuous independent assurance of the bank’s Information Security as regards confidentiality, integrity and availability of the IT Systems by ensuring that appropriate security controls are in place to protect the Bank’s assets. The role holder will also ensure that ICT related risks are managed in compliance to the Bank’s policies, laws, regulatory guidelines and applicable standards

Key Responsibilities

• Carry out ICT risk assessments of Kingdom Bank systems and provide recommendation of appropriate and adequate IT security controls to mitigate and minimize ICT Risks.
• Continuously review and improve the ICT controls in place.
• Continuously review systems at all levels i.e. servers, applications, database, network devices etc., identify risks and make recommendations on closure of the risks
• Provide continuous assurance of ICT Risks on the Bank’s systems
• Evaluate ICT controls for all operating systems, applications, database management system interfaces and networks across the Bank to ensure consistency in achieving compliance requirements (regulatory, standards and internal policies).
• Promote information security awareness within the Bank by providing consultation, guidance, and relevant awareness programs to support an information-security-compliant culture.
• Proactively anticipate potential threat and vulnerabilities and provide guidance in coordination with the ICT department on effective responses or control measures to be implemented to mitigate them.
• Manage ICT Risks registers
• Track closure of ICT audit, regulatory, vulnerability assessment, penetration testing, and risk assessment findings, and validate the adequacy of remediation actions taken by responsible teams.
• Periodically perform vulnerability assessments & penetration tests on Bank systems and technology, identifying vulnerabilities and recommendations on closure of these vulnerabilities.
• Monitor and support compliance with CBK ICT/cybersecurity guidelines, data protection requirements, and other applicable banking regulations.
• Assess ICT and cybersecurity risks arising from vendors, outsourced service providers, cloud services, fintech partners, and system integrators.
• Coordinate ICT risk input into cybersecurity incident response, including assessment of ICT risk events, escalation of material incidents, tracking of corrective actions, and reporting of lessons learned to strengthen controls.
• Review and provide assurance over ICT business continuity, disaster recovery, backup, restoration, and technology resilience arrangements to ensure critical systems support the Bank’s recovery objectives.
• Review user access, privileged access, segregation of duties, and identity lifecycle controls across critical Bank systems to identify excessive access rights, control weaknesses, and compliance gaps.
• Prepare periodic ICT risk reports, dashboards, and management updates on risk exposures, control gaps, remediation status, and emerging technology risks for relevant governance forums.
• Assess ICT and cybersecurity risks arising from system changes, new technology implementations, infrastructure upgrades, integrations, and major projects before deployment into production.
• Conduct ongoing monitoring of third-party ICT risk, including vendor security controls, service level agreements, regulatory compliance, security attestations, and remediation plans.
• Monitor the effectiveness of information security awareness initiatives through training completion, user engagement, phishing simulation results, and follow-up actions to improve security culture.
• Review cloud security, data protection, encryption, logging, monitoring, and data loss prevention controls to ensure sensitive Bank and customer information is adequately protected.
• Review the effectiveness of security monitoring, logging, alerting, vulnerability management, endpoint protection, and threat detection controls in collaboration with ICT and information security teams.

Qualifications

The successful candidate will be required to have the following skills and competencies:

• A Bachelor’s degree in information technology, Information Security or Computer Science.
• Relevant IT Security professional qualifications e.g. CISA, CISM, CEH or other relevant security certifications.
• Qualifications in API review and Mobile security will be an added advantage.
• A minimum of 5 years’ working experience in a similar role in a highly computerized environment.
• Experience in implementing Information Security Standard such as ISO 27001, COBIT.
• Understanding of ICT risk and systems security control processes
• Understanding of Information systems Architecture and operational practices
• Appreciation of Audit Methodologies.
• Experienced in Windows Enterprise servers or UNIX systems.
• Experience of working in the IT function within a banking environment will be an advantage.
• Good knowledge of cybersecurity practices (Identity and Access Management, Data Protection, Penetration Testing etc.)

• Carry out ICT risk assessments of Kingdom Bank systems and provide recommendation of appropriate and adequate IT security controls to mitigate and minimize ICT Risks.
• Continuously review and improve the ICT controls in place.
• Continuously review systems at all levels i.e. servers, applications, database, network devices etc., identify risks and make recommendations on closure of the risks
• Provide continuous assurance of ICT Risks on the Bank’s systems
• Evaluate ICT controls for all operating systems, applications, database management system interfaces and networks across the Bank to ensure consistency in achieving compliance requirements (regulatory, standards and internal policies).
• Promote information security awareness within the Bank by providing consultation, guidance, and relevant awareness programs to support an information-security-compliant culture.
• Proactively anticipate potential threat and vulnerabilities and provide guidance in coordination with the ICT department on effective responses or control measures to be implemented to mitigate them.
• Manage ICT Risks registers
• Track closure of ICT audit, regulatory, vulnerability assessment, penetration testing, and risk assessment findings, and validate the adequacy of remediation actions taken by responsible teams.
• Periodically perform vulnerability assessments & penetration tests on Bank systems and technology, identifying vulnerabilities and recommendations on closure of these vulnerabilities.
• Monitor and support compliance with CBK ICT/cybersecurity guidelines, data protection requirements, and other applicable banking regulations.
• Assess ICT and cybersecurity risks arising from vendors, outsourced service providers, cloud services, fintech partners, and system integrators.
• Coordinate ICT risk input into cybersecurity incident response, including assessment of ICT risk events, escalation of material incidents, tracking of corrective actions, and reporting of lessons learned to strengthen controls.
• Review and provide assurance over ICT business continuity, disaster recovery, backup, restoration, and technology resilience arrangements to ensure critical systems support the Bank’s recovery objectives.
• Review user access, privileged access, segregation of duties, and identity lifecycle controls across critical Bank systems to identify excessive access rights, control weaknesses, and compliance gaps.
• Prepare periodic ICT risk reports, dashboards, and management updates on risk exposures, control gaps, remediation status, and emerging technology risks for relevant governance forums.
• Assess ICT and cybersecurity risks arising from system changes, new technology implementations, infrastructure upgrades, integrations, and major projects before deployment into production.
• Conduct ongoing monitoring of third-party ICT risk, including vendor security controls, service level agreements, regulatory compliance, security attestations, and remediation plans.
• Monitor the effectiveness of information security awareness initiatives through training completion, user engagement, phishing simulation results, and follow-up actions to improve security culture.
• Review cloud security, data protection, encryption, logging, monitoring, and data loss prevention controls to ensure sensitive Bank and customer information is adequately protected.
• Review the effectiveness of security monitoring, logging, alerting, vulnerability management, endpoint protection, and threat detection controls in collaboration with ICT and information security teams.

• ICT risk assessments
• cybersecurity controls
• system vulnerabilities
• risk registers
• information security policies
• data protection requirements
• Information Technology
• Computer Science
• API review
• Mobile security
• Information Security Standard such as ISO 27001, COBIT
• ICT risk and systems security control processes
• Information systems Architecture and operational practices
• Audit Methodologies
• Windows Enterprise servers
• UNIX systems
• cybersecurity practices
• Identity and Access Management
• Data Protection
• Penetration Testing

• A Bachelor’s degree in Information Technology, Computer Science, or a related field.
• Relevant IT Security professional qualifications e.g. CISA, CISM, CEH or other relevant security certifications.
• Qualifications in API review and Mobile security will be an added advantage.
• A minimum of 5 years’ working experience in a similar role in a highly computerized environment.
• Experience in implementing Information Security Standard such as ISO 27001, COBIT.
• Understanding of ICT risk and systems security control processes
• Understanding of Information systems Architecture and operational practices
• Appreciation of Audit Methodologies.
• Experienced in Windows Enterprise servers or UNIX systems.
• Experience of working in the IT function within a banking environment will be an advantage.
• Good knowledge of cybersecurity practices (Identity and Access Management, Data Protection, Penetration Testing etc.)