Information Security Manager

The Information Security Manager is responsible overseeing and implementing the institution’s cybersecurity program and enforcing the cyber and technology policy.

Qualifications and Experience

1. Bachelor’s degree in computer science, Cybersecurity, Management Information systems, Business Administration or related field. Master’s degree will be an added advantage
   
2. 5 years of demonstrated experience in Information Security, Risk Management in a Microfinance or Banking Organization, Financial Technology or Financial services company.
   
3. Working knowledge of national and international security regulatory compliances and frameworks such as ISO 27001, NIST, COBIT and PCI DSS; Industry Certifications in CISSP, CISM, SANS GIAC, CBCI; and Security Vendor Certifications e.g Cisco, TrendMicro, Splunk, Qualys is a plus.
   

Competencies

• Excellent at Analytics and reporting
  
• Security acumen
  
• Good communication and presentation skills
  
• High Integrity/Ethics
  

1. Ensuring that the institution maintains a current enterprise-wide knowledge base of its users, devices, applications, software licenses and their relationships, Software and hardware asset inventory including Network maps and Network utilization and performance data.
   
2. Ensuring that the information systems align with the institutional needs, ICT strategy in particular information system development strategies and comply with the overall business strategies, risk appetite and ICT risk management policies of the institution while ensuring that application design development, and deployment meet FINCA Uganda’s security standards and providing cybersecurity expertise to all projects.
   
3. Designing user-focused cybersecurity controls for all internal and external users, and developing recommendations for security improvements, including documenting the cybersecurity posture of third-party vendors and their services against FINCA Uganda services.
   
4. Organizing professional cybersecurity trainings to enhance staff proficiency and ensure regular, comprehensive cyber risk assessments are conducted at least annually.
   
5. Maintaining and managing security logs and incident response, collaborating with IT teams to design, test, and monitor effective cybersecurity controls.
   
6. Ensuring that adequate processes are in place for monitoring IT systems for timely detection of cyber and technology events and incidents and supporting IT staff in resolving identified cyber incidents with proper response and reporting.
   
7. Facilitating the implementation and maintenance of IT security controls, ensuring timely delivery of assigned security tasks and activities.
   
8. Reviewing and assessing risks from exceptions/deviations to approved cyber and technology policies and procedures and obtaining senior management approval for risk assessments and ensure residual risks remain at acceptable level.
   
9. Reporting to Management and Board Risk Committees on the effectiveness of information systems, approved cybersecurity program, exceptions to the cyber and technology policies and procedures, and significant cyber or technology incidents that affected the institution during the period.
   
10. Ensuring timely update of the incident response mechanism and Business Continuity Plan using the latest cyber threat intelligence gathered and applying scenario analysis to assess potential cyber-attack, mitigating actions, and identifying potential control gaps.