Cybersecurity, Governance and Assurance Officer

Requirements

• Bachelor’s degree in Information Security, Cybersecurity, Computer Science, Information Systems, Information Technology, Risk Management, or a related field.
  
• Professional certification in one or more of the following areas is required: CISSP, CISM, CRISC, CISA, ISO 27001 Lead Implementer, ISO 27001 Lead Auditor, CCSP, or equivalent cybersecurity certification.
  
• Microsoft Security and GIAC Certifications will be an added advantage.
  
• At least seven (7) years of progressively responsible experience in cybersecurity, information security, IT risk management, security governance, compliance or IT audit, including at least three (3) years in cybersecurity governance, risk management and/or assurance.
  
• Demonstrated experience implementing or assessing cybersecurity frameworks including ISO 27001, NIST Cybersecurity Framework and CIS Controls.
  
• Experience coordinating cybersecurity governance, assurance, compliance or risk management activities within multi-stakeholder environments.
  
• Experience developing cybersecurity dashboards, scorecards or management reports.
  
• Experience preparing reports and presenting technical information to management or governance committees.
  
• Experience working with Managed Security Service Providers (MSSPs) and third-party security vendors will be an added advantage.
  
• Experience supporting Microsoft security technologies, cloud security or endpoint security solutions will be an added advantage.
  
• Experience working within international, research, development, NGO, CGIAR, or similarly federated organisations will be an added advantage.
  

Cybersecurity Strategy and Governance

• Support the development and implementation of ILRI's cybersecurity strategy, roadmap and annual work plans.
  
• Coordinate implementation of the institutional Cybersecurity Roadmap, monitor delivery against agreed milestones, track benefits realised and report progress to management.
  
• Coordinate the development, review and maintenance of cybersecurity policies, standards, procedures and guidelines.
  
• Provide trusted cybersecurity advice to Executive Management, project sponsors and business leaders to support informed, risk-based decision-making.
  
• Support the implementation of cybersecurity governance practices across the institution.
  

Cybersecurity Risk Management

• Coordinate the maintenance of the institutional cybersecurity risk register.
  
• Conduct cybersecurity risk assessments and coordinate risk mitigation activities.
  
• Monitor emerging cyber threats and vulnerabilities affecting ILRI.
  
• Prepare regular cybersecurity risk reports for management and governance committees.
  

Security Assurance and Compliance

• Coordinate vulnerability assessments, penetration testing and cybersecurity control reviews.
  
• Track remediation of identified vulnerabilities and audit findings.
  
• Support compliance with regulatory, donor, CGIAR and institutional cybersecurity requirements.
  
• Coordinate cybersecurity-related internal and external audits.
  
• Coordinate periodic cybersecurity maturity assessments and benchmarking exercises.
  
• Support compliance with data protection, privacy and information security requirements across the institution.
  
• Coordinate cybersecurity risk assessments of third-party service providers, cloud platforms, technology vendors and strategic partners, and monitor remediation of identified risks.
  

Cybersecurity Operations Coordination

• Coordinate governance activities relating to cybersecurity operations and security monitoring.
  
• Coordinate cybersecurity incident reporting, investigations and post-incident reviews.
  
• Review security monitoring outputs from internal teams and managed security service providers.
  
• Recommend improvements to security controls and monitoring capabilities.
  
• Coordinate implementation of cybersecurity improvement initiatives arising from incidents, audits, assessments and risk reviews.
  

Security Architecture and Digital Transformation

• Support security reviews for new systems, projects and technology initiatives.
  
• Provide technical input on cybersecurity considerations for cloud, data, AI and digital transformation initiatives.
  
• Support the development and implementation of governance, assurance and risk management practices for AI-enabled solutions and emerging technologies, ensuring their secure, responsible and compliant adoption across the institution.
  
• Support the adoption of secure-by-design principles across institutional projects.
  

Cybersecurity Awareness and Culture

• Develop and coordinate cybersecurity awareness and training programmes.
  
• Coordinate phishing simulations and security awareness campaigns.
  
• Promote cybersecurity awareness and responsible technology use across the institution.
  

Business Continuity and Cyber Resilience

• Support cyber resilience, business continuity and disaster recovery planning and initiatives.
  
• Coordinate cyber incident simulation and tabletop exercises.
  
• Participate in assessments of organisational preparedness for cyber incidents and recommend improvements.
  

Other Duties

• Perform any other related duties as may be assigned by the supervisor.