Manager, ICT Risk

This is an ICT Risk and Cyber Security Risk role within a banking environment. The position focuses on identifying technology and information-security risks, assessing the effectiveness of controls, supporting regulatory compliance, and helping the bank reduce exposure to cyber threats, ICT failures and business disruption.

The role is particularly suited to professionals with experience in ICT risk management, information security, technology assurance, IT audit or banking technology controls. It is not purely an IT technical role; the emphasis is on risk assessment, governance, controls, regulatory requirements and assurance.

Key responsibilities

• Conduct ICT and technology risk assessments across the bank.

• Assess the effectiveness of technical and procedural controls.

  

• Identify weaknesses in ICT and Cyber Security controls.

• Recommend practical and risk-based mitigation measures to management.

• Assess the bank’s information and cyber security capabilities, operations and supporting technology controls.

• Identify business disruption risks arising from existing business practices and strategic initiatives.

• Assess the potential impact of identified business disruption risks.

• Review ICT disaster recovery plans and identify critical points of failure.

• Recommend measures to strengthen ICT disaster recovery capabilities.

• Review and report on residual ICT risks.

• Review and improve Information and Cyber Security training and awareness programmes.

• Monitor emerging cyber and technology threats in relation to the bank’s existing risk profile.

• Convert complex ICT risk, process and control information into clear dashboards and management reports.

• Provide risk-management oversight during internal assessments and regulatory examinations.

• Support the development and improvement of the bank’s IT risk-management framework and methodologies.

• Review gaps identified during ICT risk assessments.

• Follow up with responsible teams to ensure identified ICT risk issues are properly closed.

• Periodically review ICT and Cyber Security policies, standards and guidelines.

• Provide timely feedback to internal customers regarding ICT risk matters.

• Support business units, Technology & Operations and Enterprise Projects teams on ICT risk issues.

• Work with Internal Audit, vendors and external auditors on relevant risk and assurance activities.

• Maintain continuous professional development in ICT risk, information security and banking technology.

Qualifications and experience

• University degree in a relevant field.

• A Master’s degree is an added advantage.

• Professional certification in Information Security or Risk Management, such as:

  • CRISC

  • CISM

  • CISA

  • CISSP

  • Or an equivalent certification.

• At least 4 years of experience in a similar ICT risk-related role.

• Experience or exposure to banking operations, technology or assurance functions.

• Practical knowledge of Bank of Tanzania (BoT) guidelines on ICT Risk Management.

• Practical understanding of risk and control frameworks.

• Experience applying risk and control frameworks within the financial-services industry.

• Strong analytical and risk-assessment skills.

• Ability to communicate complex technology risks in a clear and practical manner.

• Strong stakeholder-management and collaboration skills.

Key areas of expertise

The employer is essentially looking for someone who understands:

• ICT Risk Management

• Cyber Security Risk

• Information Security

• IT Governance

• IT Controls

• Technology Assurance

• Disaster Recovery and Business Continuity

• Risk and Control Frameworks

• Regulatory Compliance

• ICT Policies and Standards

• Banking Technology

• Risk Reporting and Dashboards

• Emerging Cyber Threats

Who would be a strong candidate?

A strong candidate could come from backgrounds such as:

• ICT Risk Officer

• Technology Risk Analyst

• Cyber Security Risk Analyst

• IT Risk Specialist

• IT Auditor

• Technology Assurance Specialist

• Information Security Risk Specialist

• ICT Governance Specialist

• IT Controls Specialist

The strongest applicants will combine technology knowledge with risk-management and banking experience. Someone who is technically skilled in IT but has little understanding of risk frameworks, controls, regulatory requirements or financial-services operations would not be as closely aligned.

What this role really involves

The central responsibility is to identify technology and cyber risks before they become serious business problems.

For example, the role may assess whether the bank's disaster-recovery arrangements could withstand a major ICT failure, whether cyber-security controls adequately protect information systems, whether new technology projects introduce unacceptable risks, or whether existing controls comply with regulatory expectations.

The position therefore sits between IT, Cyber Security, Risk Management, Compliance and Assurance. It requires someone who can identify weaknesses, explain their potential business impact, recommend realistic solutions and follow up until the risks are adequately addressed.

Seniority level

Mid-level ICT Risk / Technology Risk professional

The key experience threshold is at least 4 years in a similar role, together with relevant ICT risk/security certification and practical knowledge of BoT ICT Risk Management guidelines.