Manager, Information Security and Data Protection

Knowledge and experience

• Bachelor’s Degree in Information and Communication Technology (ICT), Information Systems, Computer Science, Information Security or related field required.
  
• Data Protection training/certification.
  
• Certified Information Security Manager (CISM) or ISO/IEC 27001 Lead Implementer Certificate.
  
• Certified Information Systems Auditor (CISA) or ISO/IEC 27001 Lead Auditor Certificate.
  
• Cybersecurity Technical training/certification. Certification in at least one of these areas: Ethical Hacking, CCNA, API Security, Cloud Security.
  
• Business Continuity Management certification would be an added advantage.
  
• Protect Management certification e.g. Prince2 Practitioner would be an added advantage.
  
• IT Service Governance certification e.g. ITIL would be an added advantage
  
• At least 5 years’ experience in Information Security or IT Governance, with at least 2 years handling data protection compliance in a managerial role.
  
• At least 3 years’ experience conducting information security risk assessments or IT governance and assurance/compliance assessments in an organization.
  
• Experience in the design, implementation and support of cybersecurity solutions e.g. SIEM, DAM, Vulnerability Management tools, Endpoint Protection tools, FIM, NAC, PAM etc.
  
• In-depth understanding of information security best practice & compliance standards.
  
• Experience in audit management and reporting.
  
• Knowledge of relevant CBK Prudential Guidelines and laws applicable to data protection and privacy.
  
• Prior experience working within a financial service organization will be an added advantage.
  

• Data Protection and Privacy - facilitate data privacy through transparent data protection policies, procedures and systems. Additionally, the role shall;
  
• Act as point of contact with any supervisory authorities and internal teams on data processing-related issues
  
• Identify and evaluate the organization’s data processing activities.
  
• Provide guidance in conducting Data Protection Impact Assessments (DPIAs).
  
• Inform and advise the organization (data controller/data processor) and employees involved in data processing of their obligations to comply with Data Protection Act and other applicable regulations.
  
• Monitor Compliance with the Data Protection Act, as well as internal polices related to various data protection activities, including awareness, training, and internal audits.
  
• Co-operate with the Kenya Data Commissioner and any other authority on matters relating to data protection.
  
• Information Security Management System (ISMS) Benchmarking with industry best practice/standards.
  
• Provide support in the bank’s drive to align to best practices (COBIT, ISO 27001, PCI DSS, CIS etc.), while enshrining these with the relevant policies and practices.
  
• Regulatory Compliance - keep up-to-date with regulatory guidelines (e.g. CBK prudential guidelines etc.) affecting information technology, information security, risk management and continuously update the organization’s policies, standards and procedures.
  
• Risk & Audit Management
  
• Support on planning and conducting risk assessments – covering people, processes and technology as per the bank’s risk management framework.
  
• Support the bank’s third-party risk management process ensuring compliance with internal policies as well as regulatory requirements.
  
• Play liaison role for Internal and External audits on matters information security and data protection.
  
• Track and report on audit and risk findings.
  
• Manage the Information Security Awareness program across the organization and with external stakeholders, including awareness trainings, tools and reporting.
  
• Business Continuity and Disaster Recovery Planning.