Assistant Manager Information Systems Audit

Responsible for examining, evaluating and verifying the Bank's information systems, technology processes, procedures, internal controls and data to provide independent assurance on the adequacy and effectiveness of ICT governance, risk management and controls. Plans, executes and reports on risk-based IS audits covering core banking systems, digital/agency platforms, cybersecurity, data governance, technology projects, and disaster recovery.

Key responsibilities

Ensure through planning that there are adequate internal controls in the systems, that there is adequate protection of data and ensure its integrity

Plan, execute and lead information security audits across the bank

Asses the adequacy and effectiveness of ICT governance, technology risk management, internal controls and information-security arrangements

Inspect and evaluate information systems, applications, databases, networks, operating systems, technology infrastructure and related security controls

Review the Bank’s core banking system, and other critical applications for adequacy of application controls, interfaces, configurations, data integrity, security and availability

Review controls over digital, mobile, agency banking and other electronic channels, including transaction processing, system availability, customer-data protection and fraud-prevention controls

Evaluate the efficiency, effectiveness and compliance of information systems and technology operations with Bank policies, applicable laws, regulations, regulatory guidelines and recognized professional standards

Review identity and access-management controls, including user administration, privileged access, segregation of duties, authentication and periodic access reviews

Review system acquisition, development, implementation, integration, migration and change-management processes for adequate governance, authorization, testing, security and controls

Provide independent assurance over ICT and digital-transformation projects, including project governance, system implementation, data migration and post-implementation controls

Review controls over data governance, quality, integrity, privacy, classification, retention, backup and recovery

Assess business continuity, ICT disaster recovery, system resilience, backup arrangements and recovery testing

Review third-party, outsourced, vendor and cloud technology arrangements for information-security, data-protection, service-continuity and related technology risks

Review technology incident-management processes, including identification, escalation, investigation, root-cause analysis and corrective actions

Execute and document audit procedures and ensure findings and conclusions are supported by sufficient and appropriate audit evidence

Apply Computer-Assisted Audit Techniques (CAATs), data analytics and other technology-enabled audit tools to analyse data, identify anomalies, test controls and enhance audit coverage

Perform forensic investigative systems audits as may be required

Develop rigorous best practice recommendations to improve system security on all levels

Work with management to ensure security recommendations comply with the banks operations

Collaborate with departments to improve security compliance manage risk and bolster effectiveness

Prepare reports of system audits findings in addition to providing support for sophisticated data analysis and extraction through computer assisted audit techniques (CAATs)

Monitor and validate implementation of agreed audit actions and escalate overdue, recurring or inadequately addressed issues

Qualifications and requirements

At least twelve (12) years’ relevant work experience in Public Service or Private Sector, three (3) of which must have been in a supervisory position

Master’s degree in Accounting, Finance, Business Administration (Finance and Accounting option), Information Technology, Information Systems, Computer Science, Cybersecurity or equivalent qualification from a recognized institution

Bachelor’s degree in Accounting, Finance, Business Administration (Finance and Accounting option), Information Technology, Information Systems, Computer Science or equivalent qualification from a recognized institution

Certified Information Systems Auditor (CISA) or Certified Information Security Manager (CISM) or equivalent relevant professional qualification

Registered member of ISACA or equivalent relevant recognized professional body in good standing

Attended a Management Course lasting not less than four (4) weeks from a recognized institution

Demonstrated knowledge and experience in information systems auditing

Knowledge of core banking systems, digital financial services, application controls, databases, networks and technology infrastructure

Knowledge of applicable banking, cybersecurity, data-protection and ICT regulatory requirements and relevant professional frameworks

Demonstrated ability to apply CAATs, data analytics and technology-enabled audit tools

Strong numerical, analytical, problem-solving, communication and report-writing skills

Fulfilled the requirements of Chapter Six of the Constitution of Kenya