IT Security Officer job at Brac

The IT Security Officer supports the strategies necessary to ensure the confidentiality, Integrity, and Availability of BRAC Uganda Bank’s electronic information by communicating risk to senior management, creating and maintaining enforceable policies and supporting processes, and ensuring compliance with regulatory requirements. To support these activities, the IT Security Officer shall coordinate activities with other departments, including the evaluation and deployment of security-related products. Additionally, the IT Security Officer shall ensure that a BRAC Uganda Bank system-wide disaster recovery and incident response plans are in place.

The IT Security officer also delivers IT security production services that include the administration of user logical access controls, the management of system keys and terminal specifications.

MAIN JOB RESPONSIBILITIES

• Testing the functionality and effectiveness of information security safeguards.
• Carry out Risk Assessments and Compliance Checks on running systems and new projects or initiatives, recommend solutions to the identified vulnerabilities and track their remediation with the respective departments.
• Conduct IT Security awareness training to system users in line with identified needs, the Human Resource and IT security policies
• Make periodic reports to the Manager IT security on Security vulnerabilities, breaches, attacks and feedback from awareness surveys
• Enforce and maintain policies, procedures, measures, and mechanisms to protect the confidentiality, integrity, and availability of information at BRAC Uganda Bank.
• Develop and implement information security and disaster discovery programs in accordance with approved information security standards.
• Deliver improved governance, risk management, controls and compliance requirements
• Manage the remediation of any audit issues identified by the Risk and Audit team.
• Ensure compliance with all regulatory policies and standards and provide regular communication of governance requirements to stakeholders
• Review project risk logs to identify high impact probability items and work with Risk and Compliance teams to ensure that adequate risk mitigation and risk acceptance are in place
• Review the ICT Business Continuity Management (BCM) plan prepared for all ICT processes for adequacy and ensure required tests of the plan are executed and all test failures addressed.
• Track the compliance of security controls (Antivirus, OS patches, etc.) and follow up with the control owners for timely remediation
• Ensure that processes, control requirements and risk management frameworks that impact the area are documented and understood by all members of the team
• Monitor access to all systems and maintain access control profiles on computer networks and systems.
• Determine acceptable risk levels for the enterprise and ensure the IT environments are adequately protected from potential risks and threats.
• Evaluate information security issues related to third parties in order to conform to the BRAC Uganda Bank’s Vendor Management policy.
• Manage, investigate and handle information security breach and cyber security incidents, planning and recommending remedial actions on information security breach and cyber security incidents.
• Ensure that all third-party Technology suppliers comply with the BRAC Uganda Bank BCM framework by auditing the contracts and services delivered by the vendors
• Manage and support Access Management operations and governance relating to system, infrastructure and application access, user identity lifecycle management and implementing controls to protect BRAC Uganda Bank ‘s key information.
• Support and maintain IT Security Systems.

REQUIRED QUALIFICATIONS AND SKILLS

• Bachelor’s degree in IT, Computer Science, Cybersecurity or a related field.
• A minimum of 2 years’ experience in IT Security.
• Certifications: CISSP, CISA, CEH, CISM, Security+ or other relevant certifications.

KNOWLEDGE, EXPERIENCE & COMPETENCIES

• Information Security
• Risk Assessment and Management
• Ability to communicate security-related concepts to a broad range of technical and non-technical staff.
• Solid experience in cyber security controls and incident handling
• Strong knowledge of banking regulations / guidelines relating to cyber security and technology risk management
• Strong self-motivation, with good leadership, communication, interpersonal and analytical skills
• In-depth knowledge and experience in the following information security areas:
  • Vulnerability scanning and auditing tools
  • Enterprise-scale network and host-based IDS architectures
  • Enterprise-scale firewall architectures
  • Secure messaging architectures

• Testing the functionality and effectiveness of information security safeguards.
• Carry out Risk Assessments and Compliance Checks on running systems and new projects or initiatives, recommend solutions to the identified vulnerabilities and track their remediation with the respective departments.
• Conduct IT Security awareness training to system users in line with identified needs, the Human Resource and IT security policies
• Make periodic reports to the Manager IT security on Security vulnerabilities, breaches, attacks and feedback from awareness surveys
• Enforce and maintain policies, procedures, measures, and mechanisms to protect the confidentiality, integrity, and availability of information at BRAC Uganda Bank.
• Develop and implement information security and disaster discovery programs in accordance with approved information security standards.
• Deliver improved governance, risk management, controls and compliance requirements
• Manage the remediation of any audit issues identified by the Risk and Audit team.
• Ensure compliance with all regulatory policies and standards and provide regular communication of governance requirements to stakeholders
• Review project risk logs to identify high impact probability items and work with Risk and Compliance teams to ensure that adequate risk mitigation and risk acceptance are in place
• Review the ICT Business Continuity Management (BCM) plan prepared for all ICT processes for adequacy and ensure required tests of the plan are executed and all test failures addressed.
• Track the compliance of security controls (Antivirus, OS patches, etc.) and follow up with the control owners for timely remediation
• Ensure that processes, control requirements and risk management frameworks that impact the area are documented and understood by all members of the team
• Monitor access to all systems and maintain access control profiles on computer networks and systems.
• Determine acceptable risk levels for the enterprise and ensure the IT environments are adequately protected from potential risks and threats.
• Evaluate information security issues related to third parties in order to conform to the BRAC Uganda Bank’s Vendor Management policy.
• Manage, investigate and handle information security breach and cyber security incidents, planning and recommending remedial actions on information security breach and cyber security incidents.
• Ensure that all third-party Technology suppliers comply with the BRAC Uganda Bank BCM framework by auditing the contracts and services delivered by the vendors
• Manage and support Access Management operations and governance relating to system, infrastructure and application access, user identity lifecycle management and implementing controls to protect BRAC Uganda Bank ‘s key information.
• Support and maintain IT Security Systems.

• Information Security
• Risk Assessment and Management
• Ability to communicate security-related concepts to a broad range of technical and non-technical staff.
• Solid experience in cyber security controls and incident handling
• Strong knowledge of banking regulations / guidelines relating to cyber security and technology risk management
• Strong self-motivation, with good leadership, communication, interpersonal and analytical skills
• Vulnerability scanning and auditing tools
• Enterprise-scale network and host-based IDS architectures
• Enterprise-scale firewall architectures
• Secure messaging architectures

• Bachelor’s degree in IT, Computer Science, Cybersecurity or a related field.
• Certifications: CISSP, CISA, CEH, CISM, Security+ or other relevant certifications.