ICT Risk Officer

Kingdom Bank Limited is a financial institution that provides a range of banking services.

The ICT Risk Officer is responsible for independently assuring the information security of Kingdom Bank's IT systems, focusing on confidentiality, integrity, and availability. This involves implementing and maintaining security controls to safeguard bank assets and ensuring that all ICT-related risks adhere to the bank's policies, legal requirements, regulatory guidelines, and relevant industry standards.

1. Conduct ICT risk assessments for Kingdom Bank systems and recommend appropriate IT security controls to mitigate and minimize risks.
2. Continuously review and enhance existing ICT controls.
3. Systematically review servers, applications, databases, and network devices to identify risks and propose remediation.
4. Provide ongoing assurance regarding ICT risks across the Bank's systems.
5. Evaluate ICT controls for all operating systems, applications, database management systems, and networks to ensure compliance with regulatory, standard, and internal policy requirements.
6. Promote information security awareness within the Bank through consultation, guidance, and relevant training programs.
7. Proactively identify potential threats and vulnerabilities, providing guidance to the ICT department on effective responses and control measures.
8. Manage ICT risk registers.
9. Track the closure of findings from ICT audits, regulatory reviews, vulnerability assessments, penetration tests, and risk assessments, validating the adequacy of remediation actions.
10. Periodically perform vulnerability assessments and penetration tests on Bank systems and technology, identifying vulnerabilities and recommending solutions.
11. Monitor and support compliance with CBK ICT/cybersecurity guidelines, data protection requirements, and other applicable banking regulations.
12. Assess ICT and cybersecurity risks associated with vendors, outsourced service providers, cloud services, fintech partners, and system integrators.
13. Coordinate ICT risk input into cybersecurity incident response, including assessing risk events, escalating material incidents, tracking corrective actions, and reporting lessons learned.
14. Review and assure ICT business continuity, disaster recovery, backup, restoration, and technology resilience arrangements.
15. Examine user access, privileged access, segregation of duties, and identity lifecycle controls across critical Bank systems to identify excessive access rights, control weaknesses, and compliance gaps.
16. Prepare periodic ICT risk reports, dashboards, and management updates on risk exposures, control gaps, remediation status, and emerging technology risks.
17. Assess ICT and cybersecurity risks arising from system changes, new technology implementations, infrastructure upgrades, integrations, and major projects before deployment.
18. Conduct ongoing monitoring of third-party ICT risk, including vendor security controls, service level agreements, regulatory compliance, security attestations, and remediation plans.
19. Monitor the effectiveness of information security awareness initiatives through training completion, user engagement, phishing simulation results, and follow-up actions.
20. Review cloud security, data protection, encryption, logging, monitoring, and data loss prevention controls to ensure sensitive Bank and customer information is protected.
21. Review the effectiveness of security monitoring, logging, alerting, vulnerability management, endpoint protection, and threat detection controls in collaboration with ICT and information security teams.

1. Hold a Bachelor’s degree in Information Technology, Information Security, or Computer Science.
2. Possess relevant IT Security professional qualifications such as CISA, CISM, CEH, or other pertinent security certifications.
3. Qualifications in API review and Mobile security are an added advantage.
4. Have a minimum of 5 years’ working experience in a similar role within a highly computerized environment.
5. Demonstrate experience in implementing Information Security Standards like ISO 27001 and COBIT.
6. Possess a strong understanding of ICT risk and systems security control processes.
7. Have a good understanding of Information Systems Architecture and operational practices.
8. Show appreciation for Audit Methodologies.
9. Be experienced in Windows Enterprise servers or UNIX systems.
10. Experience working in an IT function within a banking environment is an advantage.
11. Possess good knowledge of cybersecurity practices, including Identity and Access Management, Data Protection, and Penetration Testing.