Responsible for examining, evaluating and verifying the Bank's information systems, technology processes, procedures, internal controls and data to provide independent assurance on the adequacy and effectiveness of ICT governance, risk management and controls. Plans, executes and reports on risk-based IS audits covering core banking systems, digital/agency platforms, cybersecurity, data governance, technology projects, and disaster recovery.
Key responsibilities
Ensure through planning that there are adequate internal controls in the systems, that there is adequate protection of data and ensure its integrity
Plan, execute and lead information security audits across the bank
Asses the adequacy and effectiveness of ICT governance, technology risk management, internal controls and information-security arrangements
Inspect and evaluate information systems, applications, databases, networks, operating systems, technology infrastructure and related security controls
Review the Bank's core banking system, and other critical applications for adequacy of application controls, interfaces, configurations, data integrity, security and availability
Review controls over digital, mobile, agency banking and other electronic channels, including transaction processing, system availability, customer-data protection and fraud-prevention controls
Evaluate the efficiency, effectiveness and compliance of information systems and technology operations with Bank policies, applicable laws, regulations, regulatory guidelines and recognized professional standards
Review identity and access-management controls, including user administration, privileged access, segregation of duties, authentication and periodic access reviews
Review system acquisition, development, implementation, integration, migration and change-management processes for adequate governance, authorization, testing, security and controls
Provide independent assurance over ICT and digital-transformation projects, including project governance, system implementation, data migration and post-implementation controls
Review controls over data governance, quality, integrity, privacy, classification, retention, backup and recovery
Assess business continuity, ICT disaster recovery, system resilience, backup arrangements and recovery testing
Review third-party, outsourced, vendor and cloud technology arrangements for information-security, data-protection, service-continuity and related technology risks
Review technology incident-management processes, including identification, escalation, investigation, root-cause analysis and corrective actions
Execute and document audit procedures and ensure findings and conclusions are supported by sufficient and appropriate audit evidence
Apply Computer-Assisted Audit Techniques (CAATs), data analytics and other technology-enabled audit tools to analyse data, identify anomalies, test controls and enhance audit coverage
Perform forensic investigative systems audits as may be required
Develop rigorous best practice recommendations to improve system security on all levels
Work with management to ensure security recommendations comply with the banks operations
Collaborate with departments to improve security compliance manage risk and bolster effectiveness
Prepare reports of system audits findings in addition to providing support for sophisticated data analysis and extraction through computer assisted audit techniques (CAATs)
Monitor and validate implementation of agreed audit actions and escalate overdue, recurring or inadequately addressed issues
Qualifications and requirements
At least twelve (12) years' relevant work experience in Public Service or Private Sector, three (3) of which must have been in a supervisory position
Master's degree in Accounting, Finance, Business Administration (Finance and Accounting option), Information Technology, Information Systems, Computer Science, Cybersecurity or equivalent qualification from a recognized institution
Bachelor's degree in Accounting, Finance, Business Administration (Finance and Accounting option), Information Technology, Information Systems, Computer Science or equivalent qualification from a recognized institution
Certified Information Systems Auditor (CISA) or Certified Information Security Manager (CISM) or equivalent relevant professional qualification
Registered member of ISACA or equivalent relevant recognized professional body in good standing
Attended a Management Course lasting not less than four (4) weeks from a recognized institution
Demonstrated knowledge and experience in information systems auditing
Knowledge of core banking systems, digital financial services, application controls, databases, networks and technology infrastructure
Knowledge of applicable banking, cybersecurity, data-protection and ICT regulatory requirements and relevant professional frameworks
Demonstrated ability to apply CAATs, data analytics and technology-enabled audit tools
Strong numerical, analytical, problem-solving, communication and report-writing skills
Fulfilled the requirements of Chapter Six of the Constitution of Kenya