KCB BANK

Risk Department,Uganda.IT Risk Analyst

Uganda

Job Description

KEY RESPONSIBILITIES

• Conduct proactive systems reviews/assessments/data analysis to identify possible vulnerabilities for timely corrective action.
• Conduct risk assessments prior, during and after the implementation of bank strategic/business initiatives which includes tracking/monitoring the implementation of bank projects/business initiatives, active participation in implementation of bank IT projects and data analytics on performance of the same to inform business decisions.
• Scan the Market/Industry and obtain information related to cyber/system risk and preparing a monthly report for sharing with management.
• Track/monitor usage of risk tools (e.g. RCSAs, Risk Registers, KRIs Etc) within the Information Technology Department plus submission of the same to Risk Management Department within stipulated timeframes and conducting assurance reviews where appropriate and communicating test results to appropriate stakeholders.
• Driving/developing, managing and maintaining the bank’s incident management process and system plus associated procedures by ensuring that all units follow the incident management process for cyber/technology related incident.
• Participate in the implementation of the bank’s Business Continuity Management Programme in line with the bank’s Business Continuity Management Policy.
• Participate in the development, review and monitoring of compliance to Bank Policies and Procedures.
• Review of Information Systems audit reports and tracking implementation of the recommendations thereof.
• Maintain/ build relationships with all key stakeholders within the bank and assurance providers (internal and external audit, compliance and Bank of Uganda Examiners, etc.)
• Provide appropriate risk training, awareness and education to staff and teams in the bank related to Cyber and system-based risks.

DAILY RESPONSIBILITIES

• Report writing i.e. Risk assurance reporting, Senior Management reporting including routine reporting for system analytical reviews as one of the daily activities to be done for all high-risk areas that have been agreed upon with the supervisor.
• Attend to enquires, information requests, trainings etc where applicable for business units.
• Attend to scheduled and some unscheduled business activities/meetings and any other duties as may be allocated by your supervisor/departmental head from time to time in line with the bank’s expectations.

MINIMUM POSITION QUALIFICATION REQUIREMENTS

Academic & Professional

Particulars Detail Specific Field or Qualification Need Type[1]

Education Bachelor’s degree Information Technology, Computer Science, Information Science, Information Systems, Information Security or related disciplines RQ

Professional Qualifications CRISC, CISM, CISSP, CISA & related professional qualifications AA

Master’s degree IT, MBA, Computer Science & related disciplines AA

Experience

Total Minimum No of Years Experience Required 3

Detail Area Minimum No of Years Need Type[1]

Experience Area 1 Information Risk /or IT Security and/or IT Audits 3 ES

Experience Area 2 Information Risk Reviews and Vulnerability Assessments Experience 3 ES

Experience Area 3 Red Team Exercises and/or Penetration Testing Experience 2 ES

Experience Area 4 Stakeholder management 2 ES

Experience Area 5 Report writing 2 ES

• Conduct proactive systems reviews/assessments/data analysis to identify possible vulnerabilities for timely corrective action.
• Conduct risk assessments prior, during and after the implementation of bank strategic/business initiatives which includes tracking/monitoring the implementation of bank projects/business initiatives, active participation in implementation of bank IT projects and data analytics on performance of the same to inform business decisions.
• Scan the Market/Industry and obtain information related to cyber/system risk and preparing a monthly report for sharing with management.
• Track/monitor usage of risk tools (e.g. RCSAs, Risk Registers, KRIs Etc) within the Information Technology Department plus submission of the same to Risk Management Department within stipulated timeframes and conducting assurance reviews where appropriate and communicating test results to appropriate stakeholders.
• Driving/developing, managing and maintaining the bank’s incident management process and system plus associated procedures by ensuring that all units follow the incident management process for cyber/technology related incident.
• Participate in the implementation of the bank’s Business Continuity Management Programme in line with the bank’s Business Continuity Management Policy.
• Participate in the development, review and monitoring of compliance to Bank Policies and Procedures.
• Review of Information Systems audit reports and tracking implementation of the recommendations thereof.
• Maintain/ build relationships with all key stakeholders within the bank and assurance providers (internal and external audit, compliance and Bank of Uganda Examiners, etc.)
• Provide appropriate risk training, awareness and education to staff and teams in the bank related to Cyber and system-based risks.
• Report writing i.e. Risk assurance reporting, Senior Management reporting including routine reporting for system analytical reviews as one of the daily activities to be done for all high-risk areas that have been agreed upon with the supervisor.
• Attend to enquires, information requests, trainings etc where applicable for business units.
• Attend to scheduled and some unscheduled business activities/meetings and any other duties as may be allocated by your supervisor/departmental head from time to time in line with the bank’s expectations.

• Information Risk
• IT Security
• IT Audits
• Information Risk Reviews
• Vulnerability Assessments
• Red Team Exercises
• Penetration Testing
• Stakeholder management
• Report writing
• Cyber risk
• System risk
• Incident management
• Business Continuity Management
• Risk training
• Risk awareness
• Risk education

• Bachelor’s degree in Information Technology, Computer Science, Information Science, Information Systems, Information Security or related disciplines
• CRISC, CISM, CISSP, CISA & related professional qualifications
• Master’s degree in IT, MBA, Computer Science & related disciplines