POSITION DESCRIPTION

JOB TITLE: IT RISK OFFICER

REPORTS TO: MANAGER IT RISK

JOB PURPOSE

1. To provide an independent assurance to management, that established controls in respect to IT systems are operating as intended to ensure compliance with regulations and established Bank policies and procedures.

2. To support the Risk Department in driving Second Line Technology Risk Assurance activities within the bank to ensure that businesses and support functions have deployed and are executing all necessary key controls in a manner which is consistent with the Bank’s standards.

3. To ensure that the monthly Management Risk Committee process is effective in the identification, assessment, mitigation, and monitoring of bank Information Technology and Cyber risks.

KEY RESPONSIBILITIES /KEY DELIVERABLES

• Conduct Information System risk assessments for new and existing systems, applications, and programs to ensure compliance with the bank’s security policies, regulatory requirements and adherence to best practices. Identify weaknesses or security exposures and prescribe solutions to mitigate the risks related to those weaknesses and exposures.
• Perform periodic and surprise security assessments of areas such as operating systems, database management systems, firewalls, intrusion detection systems, and web-based applications.
• Identify and evaluate business technology risks and the effectiveness of internal controls designed to mitigate those risks. Recommend opportunities for strengthening internal controls and develop appropriate risk treatment plans to address identified gaps.
• Provide guidance over the general activities and concerns of the bank’s information technology function including governance, policy, control design, general operational effectiveness, and internal controls.
• Liaise and coordinate with respective Risk champions, review IT risk and control self-assessments.
• Maintain and track for closure all IT findings arising out of Risk, Internal Audit, External Audit and BOU reviews.
• Monitor and track IT risk events and follow up associated action plans to closure.
• Work with control owners to ensure control accuracy and remediation of any issues related to control exceptions.
• Maintain a forward-looking technology risk profile of the bank that captures the major risks, ensuring that risks that might impact multiple businesses and/or support functions are captured, and actions initiated to mitigate and control risks leading to a reduction in operational losses.
• Ensure that staff are adequately trained in IT Risk Management, policies, and procedures.
• Ensure that controls and checks associated with IT Risk Management deployment are in place and are effective
• Perform annual Quality Assurance Reviews of IT related policies, processes, and procedure manuals.
• Oversee the Disaster Recovery Governance framework and Implementation.
• Support in the review of IT Risk Control Self Assessments (RCSAs) & Key Risk Indicators
• Support elements of IT related Investigations.
• Conduct IT Project Risk Assessments as and when required.
• Provide risk oversight and assurance over the activities of the Business Technology, Digitization and Innovation Units.
• Provide support in the preparation of monthly ICT risk reports as part of input into the monthly Management Risk Committee meetings and quarterly Board Risk Committee meetings.
• Conduct IT Risk awareness training and share IT risk control communication across the bank to improve on risk awareness.
• Participate in fraud risk management and monitoring.

BUSINESS BEHAVIOURS

• Passion: Committed to excellence, delivering outstanding results and making a positive impact on our customers and stakeholders.
• Teamwork: Collaborates, mutual respect, and diverse perspectives, to achieve shared success and deliver greater value to the Bank.
• Integrity: Uphold honesty, transparency, and accountability, ensuring ethical practices in every action.
• Innovation: Embrace creativity and forward-thinking, continually seek new solutions to enhance customer experience and drive business growth.

QUALIFICATIONS, EXPERIENCE AND COMPETENCIES REQUIRED

• BA or BS in Information Systems Technology, Computer Science, or Engineering, or equivalent experience required
• Possess or partly qualified in one or more of the following certifications: Certified in Risk and Information Systems Control (CRISC), Certified Information Systems Auditor (CISA), or other related certification.
• At least two years’ experience in IT Audits, IT Risk management or Banking Operations.

• Conduct Information System risk assessments for new and existing systems, applications, and programs to ensure compliance with the bank’s security policies, regulatory requirements and adherence to best practices. Identify weaknesses or security exposures and prescribe solutions to mitigate the risks related to those weaknesses and exposures.
• Perform periodic and surprise security assessments of areas such as operating systems, database management systems, firewalls, intrusion detection systems, and web-based applications.
• Identify and evaluate business technology risks and the effectiveness of internal controls designed to mitigate those risks. Recommend opportunities for strengthening internal controls and develop appropriate risk treatment plans to address identified gaps.
• Provide guidance over the general activities and concerns of the bank’s information technology function including governance, policy, control design, general operational effectiveness, and internal controls.
• Liaise and coordinate with respective Risk champions, review IT risk and control self-assessments.
• Maintain and track for closure all IT findings arising out of Risk, Internal Audit, External Audit and BOU reviews.
• Monitor and track IT risk events and follow up associated action plans to closure.
• Work with control owners to ensure control accuracy and remediation of any issues related to control exceptions.
• Maintain a forward-looking technology risk profile of the bank that captures the major risks, ensuring that risks that might impact multiple businesses and/or support functions are captured, and actions initiated to mitigate and control risks leading to a reduction in operational losses.
• Ensure that staff are adequately trained in IT Risk Management, policies, and procedures.
• Ensure that controls and checks associated with IT Risk Management deployment are in place and are effective
• Perform annual Quality Assurance Reviews of IT related policies, processes, and procedure manuals.
• Oversee the Disaster Recovery Governance framework and Implementation.
• Support in the review of IT Risk Control Self Assessments (RCSAs) & Key Risk Indicators
• Support elements of IT related Investigations.
• Conduct IT Project Risk Assessments as and when required.
• Provide risk oversight and assurance over the activities of the Business Technology, Digitization and Innovation Units.
• Provide support in the preparation of monthly ICT risk reports as part of input into the monthly Management Risk Committee meetings and quarterly Board Risk Committee meetings.
• Conduct IT Risk awareness training and share IT risk control communication across the bank to improve on risk awareness.
• Participate in fraud risk management and monitoring.

• BA or BS in Information Systems Technology, Computer Science, or Engineering, or equivalent experience required
• Possess or partly qualified in one or more of the following certifications: Certified in Risk and Information Systems Control (CRISC), Certified Information Systems Auditor (CISA), or other related certification.