Job Description
JOB PURPOSE
To oversee the protection of bank and customer data, as well as the protection of infrastructure and assets from malicious actors. Serves as the process owner of all assurance activities related to the availability, integrity, and confidentiality of customer, business partner, employee, and business information in compliance with the bank’s information security policies.
KEY RESPONSIBILITIES
1. Strategy
2. Audit and Compliance
3. Policies Standards and Procedure
4. Change Management and Change Catalyst
5. Data Protection/Privacy
6. Information Security Awareness Training
7. Risk Management
8. Security Operation Center SOC
9. Business Continuity and Disaster Recovery
10. Identity and Access Management
11. Incident Reporting
12. Cyber security
MAIN ACTIVITIES
1. Strategy
o Draw out and implement a 5-year strategy plan towards the organization’s certification on ISMS – ISO27001
o Draw out a yearly Budgetary proposal towards mitigating Technology Risk in the organization
o Keep up to date with the latest security and technology developments
o Research/evaluate emerging security threats and ways to manage them
2. Audit and Compliance
o Leading auditing and security compliance initiatives.
o Ensure that an annual Central Bank of Kenya (CBK) Cyber Security Compliance Report is provided
o Drive the testing and evaluation of security products
3. Policies Standards and Procedure
o Develop and ensure up-to-date Information security policies and standards, are in place and followed through its socialization
4. Change Management and Change Catalyst.
o Introduced security Risks Assessment in the product development lifecycle
o Introduced NDA compliance from all the Vendors
o Vendor Minimum Security Baseline Evaluation
o Implement annual KPI checklist and vendor risk management for Vendors is implemented
o Design new security systems or upgrade existing ones
5. Data Protection/Privacy
o Develop a Strategy for Data Privacy Compliance and walk through its implementation.
o Data Protection Awareness Champion.
o Conducting Data Mapping and Data Protection Impact Assessment.
6. Information Security Awareness Training.
o Develop an Information Security Awareness program, prepared curriculum for different set of users and executed the program
7. Risk Management
o Maintain an information security risk register for the business
o Ensuring security on all platform infrastructure and external integrations
8. Security Operation Center SOC
o Implement Information Security Incident Management program
o Operationalize a SOC and implement a SIEM
o Identify potential weaknesses and implement measures, such as firewalls and encryption
o Implement alert closure programs in Netguardians (Fraud) solution.
o Implement End Point Security including data leak prevention, mobile device management
o Monitor and respond to phishing emails and pharming activity
o Analysis and Monitoring of entry points, activity logs, internal environments, and databases.
o Vulnerability Assessment and Penetration Testing schedule and timetable
9. Business Continuity and Disaster Recovery
o Update and implement a business continuity plan for the business.
o Conduct Business Impact Assessment and define RPO and RTOs for the business.
o Executed a tabletop and actual disaster recovery plan tests for people, systems, processes.
o Conducted drills and work on areas of improvement.
10. Identity and Access Management
o Onboarding and off-boarding of Assets
o User provisioning/ de-provisioning and Privileged Access management.
o Developed and role-based access control matrix
11. Incident Reporting
o Update and implement an incident reporting mechanism and plan for the business
o Incident reporting to CBK as required
o Investigate security alerts and provide incident response.
12. Cyber security
o Use advanced analytic tools to determine emerging threat patterns and vulnerabilities
o Engage in ethical hacking, for example, simulating security breaches
o Generate reports for both technical and non-technical staff and stakeholders.
o Data Security and Fraud Prevention.
DECISION-MAKING AUTHORITY
• Subject matter expert on Information Security, cyber security, and data Privacy
• Facilitate the following training:
1. User awareness training for all staff
2. Professional cyber-related training for technical staff
3. Cybersecurity training and updates for Board Members
4. Cybersecurity awareness for customers, suppliers, partners, outsourced service providers, and other third parties.
• Submit the required cybersecurity regulatory returns to the Central Bank of Kenya, as per the prescribed timelines.
• Ensure timely and comprehensive reports to the CEO, Senior Management, Board Audit Risk Management Committee, and the Board. These reports should be submitted at least quarterly.
• Design and periodically review the Bank’s cybersecurity program
• Support the submission of the following to the Board for approval, at least annually:
1. Cybersecurity strategy/risk management plan.
2. Cyber security policy and framework, or revisions thereof
3. Cybersecurity risk assessments and risk appetite
4. Cybersecurity budget
• Design cybersecurity controls with the consideration of users at all levels of the organization and advises the Business. Follow up with the responsible functions for implementation.
• Ensure that a business develops a cyber asset register that classifies its cybersecurity assets. Critical assets should be identified.
• Identify and facilitate compliance to data protection/ data privacy requirements.
• Manage the Security Operations Centre of the Bank to perform operational information security monitoring, testing, and threat intelligence. Where this function is outsourced, conduct oversight over and provide directions to any third-party service provider to whom this is outsourced.
• As the cybersecurity coordinator, perform the following roles:
1. Regularly review the Bank’s incident response plan. This should include a data breach response plan.
2. Regularly review the composition of the CSIRT
3. Train CSIRT members on their roles and responsibilities
4. Conduct regular tests and report test results to senior management, Board Risk Management Committee, and Board Audit Committee.
• Liaise with the Business Continuity Co-ordinator and the ICT function to ensure that adequate disaster recovery measures are in place i.e. functioning Disaster recovery site and adequate backups of critical IT systems and data in line with the required Recovery Time and Recovery Point Objectives.
ACADEMIC BACKGROUND
• A minimum of a Bachelor’s degree in Information Technology, Computer science, Cybersecurity, business, or related fields.
• A Master’s degree in IT security will be an added advantage.
WORK EXPERIENCE
• 3- 5 years Banking Experience
• Knowledgeable in IT operations
• Proficient in IS Security
• Knowledge of Data Protection laws and General Data Protection Regulations (GDPR) is an added advantage.
SKILLS and COMPETENCIES
• Excellent interpersonal and Communication Skills.
• Working in Teams.
• Excellent analytical skills.
• Organization skills.
• Problem-solving skills.
• Excellent knowledge of security tools.
• Report writing skills.
PROFESSIONAL CERTIFICATION
• Professional qualification such as Certified Information Systems Security Professional CISA, Certified Information Systems Security Professional CISM or Certified Information Systems Security Professional (CISSP).
• Member of ISACA.