Assistant Director, ICT, Information Systems Security & Data Protection at Higher Education Loans Board (HELB)

Ref. No. HELB/009 - Grade 4

Job Profile

The job holder is responsible for developing and implementing an information security program, which includes procedures and policies designed to protect enterprise communications, systems and assets from both internal/external threats and assurance of Business recovery strategies through an elaborate Business Continuity Plan (BCP)/Disaster Recovery Site(DRS) Governance Framework.

Information Systems Security & Data Protection

• Implementing the ICT strategy to ensure that the long- and short-term ICT plans are aligned to the overall business strategy;
• Implementing and monitoring ICT Work Plans, Policies, standard operating procedures and best practices to provide guidance to users;
• Coordinating maintenance of computerized prosecution processes, case management system, network Infrastructure administration and upgrading of network systems and desktop environment;
• Supervising compliance with all regulations, procedures, policies and quality standards in the delivery of services;
• Implementing the Divisional budget and Procurement Plans;
• Implementing the ICT disaster management strategies to ensure the network systems, physical environment, data and users are protected against cybercrime, risk exposure, unauthorized access and data loss in line with Kenya Information and Communication Act and Kenya Cyber Security and Protection Bill;
• Implementing the ICT risk management framework that supports the management of ICT related risks for the integrity and confidentiality of information;
• Preparing ICT user training programs and materials in liaison with Human Resource Management & development as well as other relevant Authorities;
• Implementing the ICT security infrastructure that is responsive to the requirements and that upholds best practices;
• Implementing the disaster recovery systems and business continuity plans;
• Preparing quarterly and annual divisional reports and share with the management for informed decision making;
• Ensure organization’s handling and collection of personal data of its staff, customers, providers or any other data subjects in compliance with the applicable data protection rules; and
• Supervising performance management in the Division

Person Specification

For appointment to this grade an officer must have: -

• Served for a cumulative period of twelve (12) years relevant work experience three (3) of which must have been at the grade of Principal Information Communication Technology Officer or in a comparable position;
• Bachelor’s degree in information technology, Computer Science, Business IT, Software Engineering, ICT Project Management, Computer Engineering or any other equivalent qualification from a recognized Institution;
• Master’s Degree in any of the following disciplines: - Information Technology, Computer Science, Business Information Technology, Software Engineering, Project Management, Business Administration, DataScience, Computer Engineering or any other equivalent qualification from a recognized Institution;
• Leadership Course lasting not less than four (4) weeks from a recognized institution.
• Professional qualification in any two of the following: CISA/CISM/CRISM/ CEH/ CISSP/MCSE/MCITP/CCNA/Project Management Certification; SSCP; CompTIA Security+; OSCP/ VOIP;
• Membership of a relevant professional body and in good standing where applicable.
• A valid practicing certificate where applicable; and
• Shown merit and ability as reflected in work performance and results.

Key Skills and Competencies

• Communication.
• Experience in Configurations of top tier ERP solutions
• Proficiency in programming;
• Data Base Querying;
• Data Analytics;
• Demonstrate appetite for Innovation & Disruptive Technologies;
• Team player;
• Interpersonal skills;
• Emotional intelligence
• Data Integration, Data Warehousing, Business Intelligence, OLAP, and Data mining as well as familiarity with ICT standards such as ITIL, COBIT
• Risk management and Reporting
• Information and network security
• Experience with Unix/Linux/Windows Operating systems
• Experience with contact center technologies
• Management course lasting not less than Four (4) weeks;