Job particulars
- Job title
- ICT Risk Officer
- Hiring organisation
- s Expand Recruitment Services
- Location
- Nairobi, Kenya
- Employment type
- Full-time
- Work arrangement
- On-site
- Industry
- IT
- Level
- Middle
- Posted
- 26 Oct 2026
- Closing date
- 2 Nov 2026
Key responsibilities
- Carry out ICT risk assessments of Kingdom Bank systems and provide recommendation of appropriate and adequate IT security controls to mitigate and minimize ICT Risks.
- Continuously review and improve the ICT controls in place.
- Continuously review systems at all levels i. e. servers, applications, database, network devices etc., identify risks and make recommendations on closure of the risks.
- Provide continuous assurance of ICT Risks on the Bank’s systems.
- Evaluate ICT controls for all operating systems, applications, database management system interfaces and networks across the Bank to ensure consistency in achieving compliance requirements (regulatory, standards and internal policies).
- Promote information security awareness within the Bank by providing consultation, guidance, and relevant awareness programs to support an information-security-compliant culture.
- Proactively anticipate potential threat and vulnerabilities and provide guidance in coordination with the ICT department on effective responses or control measures to be implemented to mitigate them.
- Manage ICT Risks registers.
- Track closure of ICT audit, regulatory, vulnerability assessment, penetration testing, and risk assessment findings, and validate the adequacy of remediation actions taken by responsible teams.
- Periodically perform vulnerability assessments & penetration tests on Bank systems and technology, identifying vulnerabilities and recommendations on closure of these vulnerabilities.
- Monitor and support compliance with CBK ICT/cybersecurity guidelines, data protection requirements, and other applicable banking regulations.
- Assess ICT and cybersecurity risks arising from vendors, outsourced service providers, cloud services, fintech partners, and system integrators.
- Coordinate ICT risk input into cybersecurity incident response, including assessment of ICT risk events, escalation of material incidents, tracking of corrective actions, and reporting of lessons learned to strengthen controls.
- Review and provide assurance over ICT business continuity, disaster recovery, backup, restoration, and technology resilience arrangements to ensure critical systems support the Bank’s recovery objectives.
- Review user access, privileged access, segregation of duties, and identity lifecycle controls across critical Bank systems to identify excessive access rights, control weaknesses, and compliance gaps.
- Prepare periodic ICT risk reports, dashboards, and management updates on risk exposures, control gaps, remediation status, and emerging technology risks for relevant governance forums.
- Assess ICT and cybersecurity risks arising from system changes, new technology implementations, infrastructure upgrades, integrations, and major projects before deployment into production.
- Conduct ongoing monitoring of third-party ICT risk, including vendor security controls, service level agreements, regulatory compliance, security attestations, and remediation plans.
- Monitor the effectiveness of information security awareness initiatives through training completion, user engagement, phishing simulation results, and follow-up actions to improve security culture.
- Review cloud security, data protection, encryption, logging, monitoring, and data loss prevention controls to ensure sensitive Bank and customer information is adequately protected.
- Review the effectiveness of security monitoring, logging, alerting, vulnerability management, endpoint protection, and threat detection controls in collaboration with ICT and information security teams.
Candidate requirements
- The successful candidate will be required to have the following skills and competencies:.
- A Bachelor’s degree in information technology, Information Security or Computer Science.
- Relevant IT Security professional qualifications e. g. CISA, CISM, CEH or other relevant security certifications.
- Qualifications in API review and Mobile security will be an added advantage.
- A minimum of 5 years’ working experience in a similar role in a highly computerized environment.
- Experience in implementing Information Security Standard such as ISO 27001, COBIT.
- Understanding of ICT risk and systems security control processes.
- Understanding of Information systems Architecture and operational practices.
- Appreciation of Audit Methodologies.
- Experienced in Windows Enterprise servers or UNIX systems.
- Experience of working in the IT function within a banking environment will be an advantage.
- Good knowledge of cybersecurity practices (Identity and Access Management, Data Protection, Penetration Testing etc.)
Ready to apply?
Start ApplicationCandidate safety
Never pay an employer or recruiter for a job offer. Review the application instructions after signing in and report suspicious vacancies to Kebarick.
Hiring organisation
s Expand Recruitment Services