Responsible for providing leadership and coordination to the IT Security and monitoring computer networks and ICT infrastructure against cyber-attacks, security threats or unauthorized access to safeguard the Bank's data and knowledge base. Ensures the integrity, availability, confidentiality and authenticity of all information assets of the Bank.
Key responsibilities
Review security reports that arise from security incidents and ensure that proper investigations have been carried out and remedial actions put in place
Ensure the Bank complies with local regulations e.g. encryption regulations and privacy laws
Enforce compliance to ICT Security policy of the Bank
Ensure changes made to ICT systems strictly adhere to change management policy of the Bank and do not affect availability of services
Oversee the development, update, communicate and publish the Information Security Policy and other operational security policies
Review the Bank's ICT security controls and security strategies while ensuring that the procedures for operating and maintaining those controls are in place
Ensure that the Confidentiality, Integrity and Availability of services are maintained at the levels agreed in the Operation Level Agreements (OLAs)
Ensure that all access to services by external partners and suppliers is subject to contractual agreements and responsibilities (e.g. non-disclosure agreements) and are closely monitored
Ensure all changes to access are assessed for impact on all security aspects; including information security policy and controls
Oversee the ICT security risk analysis and risk management in coordination with Risk and ICT Service Continuity Management functions
Oversee the Bank's ICT security awareness program to ensure the technology organisation employees understand the risks / threats to their business, their responsibilities and how to comply with policies
Manage Coordinate the development and testing of the Bank's Disaster Recovery Plans (DRPs)
Oversee the design, development and delivery of enterprise level identity and access management solutions
Ensue that there is a strategy for Identity and Access Management services that are robust and scalable to support the employees, contractors, partners and vendors
Interact with other department to ensure that staff have the correct level of access to systems and applications
Provide security services to and complement the information technology architecture while integrating with the business global architecture
Oversee the analysis, design, building, testing, and deployment activities related to IAM components
Act as trusted security architecture advisor to provide strategic direction in leading activities in support of Identity Lifecycle management tools and technologies and enterprise security objectives
Review solutions and recommendations for issues caused by process challenges, emerging threats and technology changes
Manage and support security infrastructure systems & devices (including Access Control Systems, Patch Management Systems, Web Application Firewalls, Database Security, Authentication Systems etc.)
Oversee the development and implementation of an ICT Risk Management Framework and Security Control Framework
Review and recommend security controls & configurations on systems, databases and network infrastructure
Perform hardening of various operating, applications and database systems
Design and implement ICT security architecture and proactively patching and implementing secure configurations and protocols on ICT systems
Provide security guidance during technology projects, systems deployment, upgrades and changes
Enforce the Bank's Information Security policies on ICT systems and equipment as well as develop security solutions to mitigate against identified security vulnerabilities
Liaise with various stakeholders in the Bank and external partners in enforcing ICT security standards for ICT infrastructure
Qualifications and requirements
At least twelve (12) years relevant work experience in Public service or Private sector, three (3) of which must be in a supervisory level
Master's Degree in Information Technology, Computer Science, Business IT, Software Engineering, ICT Project Management, Computer Engineering or equivalent qualification from a recognized Institution
Bachelor's Degree in Information Technology, Computer Science, Business IT, Software Engineering, ICT Project Management, Computer Engineering or equivalent qualification from a recognized Institution
Certification in CCNA/CCNP/CISA/CISM/CISSP or other equivalent security certifications/qualifications from a recognized institution
Management course of not less than four (4) weeks from a recognized institution
Knowledge of trends in ICT in the banking and financial services sectors
Good understanding of business support services and their related technologies
Experience in managing administering systems and infrastructure and managing all business support software and ICT/communications infrastructure
In depth knowledge of server, clients, mobile operating systems and RDBMS with demonstrated understanding of security architecting of information systems
In depth knowledge of tools used to secure and test security of information systems
Demonstrated knowledge of threats and attack vectors as well as incident response and management
Strong Vulnerability management experience
Solid knowledge of security standards, ICT security regulatory and compliance regulations and standards
Knowledge of various programming and scripting languages (e.g., .Net, Java, Perl, C#)
Knowledge of and practical experience with various Internet protocols (e.g., DNS, TCPIP, SMTP, HTTP, SSL)
Strong understanding and knowledge of ICT risk assessment, risk procedures, security assessment, vulnerability management, penetration testing
Possess high levels of integrity, ethical standards and professionalism
Fulfilled the requirements of Chapter Six of the Constitution