Job Purpose Statement

Key Accountabilities (Duties and Responsibilities)

Internal business processes 75% 

• Undertake risk assessments, analyse the effectiveness of technical and procedural control activities, and provide actionable recommendations to management.
• Assess the Bank’s information and Cyber Security capabilities, operations and supporting technology controls to identify risks and recommend pragmatic risk mitigation measures.
• Identify and assess business disruption risks and their impacts associated with current business practices and strategic plans.
• Identify critical points of failure in the Bank’s ICT disaster recovery plans and recommend risk mitigation measures based on best practice standards.
• Review and report on the residual ICT risks.
• Review and improve the training and awareness programs for Information and Cyber Security in the bank.
• Succinctly frame emerging threats and risk in alignment with the existing risk profile.

• Distil complex risk, process and control relationships into simple dashboards/reports.
• Demonstrate robust risk management oversight in supporting various internal assessments and regulatory examinations.
• Support the development of the IT risk management practice, framework and methodologies.
• Review, report and follow-up on closure of any noted gaps during the ICT risk assessments.
• Periodical review of the ICT and Cyber Security policy, standards and guidelines.

Customer 15% 

•  Drive customer satisfaction through timely ICT risk Assessments that have been put in place to support business.
• Proving prompt feedback on internal customer queries on ICT.

Learning and growth 10% 

Responsible for delivering the performance objectives set and managing his/her own learning and development to build capacity and avail him/herself for coaching and training opportunities.

Job Specifications

• University Degree in a relevant field
• Master’s degree will be an added advantage
• Relevant certifications in Information Security and Risk Management knowledge areas such as CRISC, CISM, CISA, CISSP or equivalent.
• At least 4 years’ experience in a similar role with exposure to Banking operations, Technology or Assurance functions.
• Practical Knowledge of BOT guidelines on ICT Risk Management.
• Practical Knowledge of risk and control frameworks and their application within the Financial Services industry

Job Dimensions

Reporting Relationships: jobs that report to this position directly and indirectly 

Direct Reports

Indirect Reports

Stakeholder Management: key stakeholders that the position holder will need to liaise/work with to be successful in this role. 

Internal 

• Internal
  • Business Units
  • Technology & Operations
  • Enterprise Projects team
  • Internal Audit

External

• Vendors
• External Auditors

NCBA Bank Core Value Behaviours