Chief Information Security Officer

Qualification:

• University Graduate with minimum of a Bachelor’s degree in the field of Compute Science, Information Technology, Information Security or related fields from an accredited university.
  

• Candidates with certifications like Certified Information Systems Security Professional (CISSP), Certified Security Manager (CISM) or Certified Information Systems Auditor (CISA) qualification may be given preference.
  

• Experiences, preferably in a banking environment.
  

• Working knowledge of IFRS, Ugandan tax legislation, and Financial Institutions Act (FIA) 2004.
  

Requirements:

• Applicant should possess good experience in cyber security management, risk governance and strategic risk in technology and innovation.
  

Experience:

• Five (5) years post-qualification experience, preferably in banking sector in Uganda.
  

• Risk management, regulatory compliance, security frame work i.e. NIST, ISO 27001 and business continuity planning
  

• Strong leadership and team management capabilities
  

• Ability to influence and collaborate with Board members, senior management and cross functional team
  

• Exceptional analytical skills to evaluate and prioritize risk based or potential impact.
  

• Excellent communication and presentation skills to convey complex risk concept to diverse audiences.
  

• To oversee and implement the bank’s cybersecurity program and enforcing the cyber and technology policy.
  

• To ensure that the bank maintains a current enterprise-wide knowledge base of its users, devices, applications, software licenses and their relationships.
  

• To ensure that information systems meet the needs of the Bank, and the ICT strategy, in particular information system development strategies, comply with the overall business strategies, risk appetite and ICT risk management policies of the Bank.
  

• To design cybersecurity controls with the consideration of users at all levels of the organization, including internal and external users.
  

• To organize professional cyber related trainings to improve technical proficiency of staff.
  

• To ensure that regular and comprehensive cyber risk assessments are conducted at least once a year.
  

• To ensure that adequate processes are in place for monitoring IT systems to detect cyber and technology events and incidents in a timely manner.
  

• To review and assess risks associated with exceptions/deviations to the approved cyber and technology policies and procedures and gain senior management approval for risk assessments.