Assistant Manager Information Systems Audit

About the role

• Responsible for examining, evaluating and verifying the Bank's information systems, technology processes, procedures, internal controls and data to provide independent assurance on the adequacy and effectiveness of ICT governance, risk management and controls. Plans, executes and reports on risk-based IS audits covering core banking systems, digital/agency platforms, cybersecurity, data governance, technology projects, and disaster recovery.

Key responsibilities

• Ensure through planning that there are adequate internal controls in the systems, that there is adequate protection of data and ensure its integrity
• Plan, execute and lead information security audits across the bank
• Asses the adequacy and effectiveness of ICT governance, technology risk management, internal controls and information-security arrangements
• Inspect and evaluate information systems, applications, databases, networks, operating systems, technology infrastructure and related security controls
• Review the Bank's core banking system, and other critical applications for adequacy of application controls, interfaces, configurations, data integrity, security and availability
• Review controls over digital, mobile, agency banking and other electronic channels, including transaction processing, system availability, customer-data protection and fraud-prevention controls
• Evaluate the efficiency, effectiveness and compliance of information systems and technology operations with Bank policies, applicable laws, regulations, regulatory guidelines and recognized professional standards
• Review identity and access-management controls, including user administration, privileged access, segregation of duties, authentication and periodic access reviews
• Review system acquisition, development, implementation, integration, migration and change-management processes for adequate governance, authorization, testing, security and controls
• Provide independent assurance over ICT and digital-transformation projects, including project governance, system implementation, data migration and post-implementation controls
• Review controls over data governance, quality, integrity, privacy, classification, retention, backup and recovery
• Assess business continuity, ICT disaster recovery, system resilience, backup arrangements and recovery testing
• Review third-party, outsourced, vendor and cloud technology arrangements for information-security, data-protection, service-continuity and related technology risks
• Review technology incident-management processes, including identification, escalation, investigation, root-cause analysis and corrective actions
• Execute and document audit procedures and ensure findings and conclusions are supported by sufficient and appropriate audit evidence
• Apply Computer-Assisted Audit Techniques (CAATs), data analytics and other technology-enabled audit tools to analyse data, identify anomalies, test controls and enhance audit coverage
• Perform forensic investigative systems audits as may be required
• Develop rigorous best practice recommendations to improve system security on all levels
• Work with management to ensure security recommendations comply with the banks operations
• Collaborate with departments to improve security compliance manage risk and bolster effectiveness
• Prepare reports of system audits findings in addition to providing support for sophisticated data analysis and extraction through computer assisted audit techniques (CAATs)
• Monitor and validate implementation of agreed audit actions and escalate overdue, recurring or inadequately addressed issues

Qualifications and requirements

• At least twelve (12) years' relevant work experience in Public Service or Private Sector, three (3) of which must have been in a supervisory position
• Master's degree in Accounting, Finance, Business Administration (Finance and Accounting option), Information Technology, Information Systems, Computer Science, Cybersecurity or equivalent qualification from a recognized institution
• Bachelor's degree in Accounting, Finance, Business Administration (Finance and Accounting option), Information Technology, Information Systems, Computer Science or equivalent qualification from a recognized institution
• Certified Information Systems Auditor (CISA) or Certified Information Security Manager (CISM) or equivalent relevant professional qualification
• Registered member of ISACA or equivalent relevant recognized professional body in good standing
• Attended a Management Course lasting not less than four (4) weeks from a recognized institution
• Demonstrated knowledge and experience in information systems auditing
• Knowledge of core banking systems, digital financial services, application controls, databases, networks and technology infrastructure
• Knowledge of applicable banking, cybersecurity, data-protection and ICT regulatory requirements and relevant professional frameworks
• Demonstrated ability to apply CAATs, data analytics and technology-enabled audit tools
• Strong numerical, analytical, problem-solving, communication and report-writing skills
• Fulfilled the requirements of Chapter Six of the Constitution of Kenya