Assistant Manager Information Systems Audit

Postbank is a financial institution in Kenya that provides banking services to individuals and businesses across the country.

The Assistant Manager Information Systems Audit is responsible for providing independent assurance on the adequacy and effectiveness of ICT governance, risk management, and controls within Postbank. This involves a comprehensive examination, evaluation, and verification of the bank's information systems, technology processes, procedures, internal controls, and data. The role includes planning, executing, and reporting on risk-based IS audits that encompass core banking systems, digital and agency platforms, cybersecurity measures, data governance practices, technology projects, and disaster recovery plans.

1. Ensure adequate internal controls, data protection, and data integrity through thorough planning.
2. Plan, execute, and lead information security audits across the bank.
3. Assess the sufficiency and effectiveness of ICT governance, technology risk management, internal controls, and information security arrangements.
4. Inspect and evaluate information systems, applications, databases, networks, operating systems, technology infrastructure, and associated security controls.
5. Review the bank's core banking system and other critical applications for control adequacy, interfaces, configurations, data integrity, security, and availability.
6. Examine controls over digital, mobile, and agency banking channels, including transaction processing, system availability, customer data protection, and fraud prevention.
7. Evaluate the efficiency, effectiveness, and compliance of information systems and technology operations with bank policies, laws, regulations, and professional standards.
8. Review identity and access management controls, including user administration, privileged access, segregation of duties, authentication, and periodic access reviews.
9. Assess system acquisition, development, implementation, integration, migration, and change management processes for proper governance, authorization, testing, security, and controls.
10. Provide independent assurance for ICT and digital transformation projects, covering governance, system implementation, data migration, and post-implementation controls.
11. Review controls related to data governance, quality, integrity, privacy, classification, retention, backup, and recovery.
12. Evaluate business continuity, ICT disaster recovery, system resilience, backup arrangements, and recovery testing.
13. Review third-party, outsourced, vendor, and cloud technology arrangements for information security, data protection, service continuity, and related technology risks.
14. Examine technology incident management processes, including identification, escalation, investigation, root cause analysis, and corrective actions.
15. Execute and document audit procedures, ensuring findings and conclusions are supported by sufficient and appropriate audit evidence.
16. Apply Computer-Assisted Audit Techniques (CAATs), data analytics, and other technology-enabled audit tools for data analysis, anomaly identification, control testing, and enhanced audit coverage.
17. Conduct forensic investigative systems audits as required.
18. Develop rigorous best practice recommendations to enhance system security at all levels.
19. Collaborate with management to ensure security recommendations align with bank operations.
20. Work with departments to improve security compliance, manage risk, and bolster effectiveness.
21. Prepare reports on system audit findings and provide support for sophisticated data analysis and extraction using CAATs.
22. Monitor and validate the implementation of agreed audit actions, escalating overdue, recurring, or inadequately addressed issues.

1. At least twelve (12) years of relevant work experience in Public Service or Private Sector, with a minimum of three (3) years in a supervisory position.
2. Master’s degree in Accounting, Finance, Business Administration (Finance and Accounting option), Information Technology, Information Systems, Computer Science, Cybersecurity, or an equivalent qualification from a recognized institution.
3. Bachelor’s degree in Accounting, Finance, Business Administration (Finance and Accounting option), Information Technology, Information Systems, Computer Science, or an equivalent qualification from a recognized institution.
4. Certified Information Systems Auditor (CISA) or Certified Information Security Manager (CISM) or an equivalent relevant professional qualification.
5. Registered member of ISACA or an equivalent relevant recognized professional body in good standing.
6. Completion of a Management Course lasting not less than four (4) weeks from a recognized institution.
7. Demonstrated knowledge and experience in information systems auditing.
8. Knowledge of core banking systems, digital financial services, application controls, databases, networks, and technology infrastructure.
9. Familiarity with applicable banking, cybersecurity, data protection, and ICT regulatory requirements and relevant professional frameworks.
10. Proven ability to apply CAATs, data analytics, and technology-enabled audit tools.
11. Strong numerical, analytical, problem-solving, communication, and report-writing skills.
12. Fulfilled the requirements of Chapter Six of the Constitution of Kenya.