IT Risk Analyst - Risk Department

About the role

KCB Group is hiring a full-time IT Risk Analyst for its Risk Department in Kampala, Uganda. The role covers proactive identification of IT vulnerabilities, risk assessments linked to bank projects, incident management, business continuity and compliance reporting.

Key responsibilities

• Conduct proactive systems reviews, assessments and data analysis to spot vulnerabilities and recommend timely corrective action.
• Carry out risk assessments before, during and after bank strategic and business initiatives, track project implementation, take part in IT projects and analyse their performance to inform business decisions.
• Scan the market and industry for cyber and system risk, and prepare a monthly report for management.
• Monitor the use of risk tools (RCSAs, Risk Registers, KRIs) in the IT department, submit them to Risk Management on time and run assurance reviews, communicating results to stakeholders.
• Drive and maintain the bank's incident management process and procedures for cyber and technology incidents.
• Take part in the Business Continuity Management programme and in reviewing compliance with bank policies and procedures.
• Review information systems audit reports and track the implementation of their recommendations.
• Maintain relationships with internal and external auditors, compliance and Bank of Uganda examiners, and provide risk training and awareness to staff.
• Daily: write risk assurance and senior management reports, answer enquiries and attend scheduled and unscheduled meetings and other duties assigned by the supervisor.

Required profile

• Bachelor's degree in Information Technology, Computer Science, Information Science, Information Systems, Information Security or a related discipline (required).
• Professional qualification such as CRISC, CISM, CISSP or CISA is an added advantage; a master's degree is also an added advantage.
• Minimum 3 years of experience in information risk, IT security and/or IT audits.
• 3 years of experience in information risk reviews and vulnerability assessments.
• 2 years each in red team exercises or penetration testing, stakeholder management and report writing.