Post Bank • Nairobi, Nairobi, Kenya
The Assistant Manager, Information Technology Security will be responsible for providing leadership and coordination to the IT Security and is responsible for monitoring computer networks and ICT infrastructure against cyber-attacks, security threats or unauthorized access to safeguard the Bank’s data and knowledge base.
The job holder’s role is to ensure the integrity, availability, confidentially and authenticity of all information assets of the Bank.
Review security reports that arise from security incidents and ensure that proper investigations have been carried out and remedial actions put in place.
Ensure the Bank complies with local regulations e.g. encryption regulations and privacy laws.
Enforce compliance to ICT Security policy of the Bank.
Ensure changes made to ICT systems strictly adhere to change management policy of the Bank and do not affect availability of services.
Oversee the development, update, communicate and publish the Information Security Policy and other operational security policies.
Review the Bank’s ICT security controls and security strategies while ensuring that the procedures for operating and maintaining those controls are in place.
Ensure that the Confidentiality, Integrity and Availability of services are maintained at the levels agreed in the Operation Level Agreements (OLAs).
Ensure that all access to services by external partners and suppliers is subject to contractual agreements and responsibilities (e.g. non-disclosure agreements) and are closely monitored.
Ensure all changes to access are assessed for impact on all security aspects; including information security policy and controls.
Oversee the ICT security risk analysis and risk management in coordination with Risk and ICT Service Continuity Management functions.
Oversee the Bank’s ICT security awareness program to ensure the technology organisation employees understand the risks / threats to their business, their responsibilities and how to comply with policies.
Manage Coordinate the development and testing of the Bank’s Disaster Recovery Plans (DRPs).
Oversee the design, development and delivery of enterprise level identity and access management solutions.
Ensue that there is a strategy for Identity and Access Management services that are robust and scalable to support the employees, contractors, partners and vendors.
Interact with other department to ensure that staff have the correct level of access to systems and applications.
Provide security services to and complement the information technology architecture while integrating with the business global architecture.
Oversee the analysis, design, building, testing, and deployment activities related to IAM components.
Act as trusted security architecture advisor to provide strategic direction in leading activities in support of Identity Lifecycle management tools and technologies and enterprise security objectives.
Review solutions and recommendations for issues caused by process challenges, emerging threats and technology changes.
Manage and support security infrastructure systems & devices (including Access Control Systems, Patch Management Systems, Web Application Firewalls, Database Security, Authentication Systems etc.).
Oversee the development and implementation of an ICT Risk Management Framework and Security Control Framework.
Review and recommend security controls & configurations on systems, databases and network infrastructure.
Perform hardening of various operating, applications and database systems.
Design and implement ICT security architecture and proactively patching and implementing secure configurations and protocols on ICT systems.
Provide security guidance during technology projects, systems deployment, upgrades and changes.
Enforce the Bank’s Information Security policies on ICT systems and equipment as well as develop security solutions to mitigate against identified security vulnerabilities.
Liaise with various stakeholders in the Bank and external partners in enforcing ICT security standards for ICT infrastructure.
At least twelve (12) years relevant work experience in Public service or Private sector, three (3) of which must be in a supervisory level.
Master’s Degree in any of the following disciplines: Information Technology, Computer Science, Business IT, Software Engineering, ICT Project Management, Computer Engineering or equivalent qualification from a recognized Institution.
Bachelor’s Degree in any of the following fields: Information Technology, Computer Science, Business IT, Software Engineering, ICT Project Management, Computer Engineering or equivalent qualification from a recognized Institution.
Certification in either Cisco Certified Network Associate (CCNA)/ Cisco certified network professional (CCNP) Certified Information Systems Auditor (CISA) certification/ Certified Information Systems Manager (CISM) certification/ Certified Information Systems Security Professional (CISSP) or other equivalent security certifications/qualifications from a recognized institution.
Management course of not less than four (4) weeks from a recognized institution.
Knowledge of trends in ICT in the banking and financial services sectors.
Good understanding of business support services and their related technologies i.e. to support core banking systems, logistics, administrative, finance and HR activities.
Experience in managing administering systems and infrastructure and in managing all business support software and ICT and communications infrastructure.
In depth knowledge of server, clients, mobile operating systems and RDBMS with demonstrated understanding of security architecting of information systems in general.
In depth knowledge of tools used to secure and test security of information systems.
Demonstrated knowledge of threats and attack vectors as well as incident response and management.
Strong Vulnerability management experience.
Solid knowledge of security standards, ICT security regulatory and compliance regulations and standards.
Knowledge of various programming and scripting languages (e.g., .Net, Java, Perl, C#).
Knowledge of and practical experience with various Internet protocols (e.g., DNS, TCPIP, SMTP, HTTP, SSL;
Strong understanding and knowledge of ICT risk assessment, risk procedures, security assessment, vulnerability management, penetration testing.
Possess high levels of integrity, ethical standards and professionalism.
Ability to drive change and emotional intelligence.
Independence and objectivity and attention to detail.
Strong interpersonal, written, and oral communication skills.
Ability to prioritize and execute tasks in a high-pressure environment and make sound decisions in emergency situations.
Highly self-motivated, with good analytical and problem-solving abilities.
Strong customer service orientation.
Experience working in a team-oriented, collaborative environment.
Shown merit and ability as reflected in work performance and results.
Fulfilled the requirements of Chapter Six of the Constitution.