IRM Analyst at Absa Bank Limited

Job Summary

To provide specialist advise and support in the generation and provision of reliable business intelligence to support key deliverables and informed decision making, through the execution of predefined objectives as per agreed SOPs.
Job Description

Function and Business Area Purpose

About  Information Risk Management and Data Privacy

Information Risk Management and Data Privacy’s role is “to safeguard the integrity and security of Absa Bank Kenya's data, infrastructure and applications by identifying, managing and leading, either directly or through partnerships, all aspects of Information Risk and Security. IRM & DP integrates processes, people and technology to manage Information Risk and Data Privacy in accordance with the Bank's operating model and risk appetite."

Job Purpose

The job holder will be a member of the Kenya Information Risk Management and Data Privacy Teams responsible for implementing the Logical Access Management guidelines across ABK.   The primary function of the role is to ensure information is protected effectively and consistently based on its criticality. Ensure that all activities and duties are carried out in full compliance with regulatory requirements, Enterprise Wide Risk Management Framework and internal Absa Policies and Policy Standards. Understand and manage risks and risk events (incidents) relevant to the role.

Controls Agenda: Ensure that all activities and duties are carried out in full compliance with regulatory requirements, Enterprise Wide Risk Management Framework and internal Absa Policies and Policy Standards. Understand and manage risks and risk events (incidents) relevant to the role.

Main accountabilities and approximate time split

1. Accountability: 30 %
   1. Oversee and support Information Risk Management in the following areas:
   2. Assisting the IRM team with identifying appropriate mandates/role profiles for employees, contractors and vendors.
   3. Establish and/or support processes for users management (joiners/movers/leavers).
   4. Support of the BUs in identifying Toxic Combinations and Segregation of Duties in regards to system access.
   5. Manage Information Security Violations Monitoring processes
2. Accountability: 10 %
   1. Develop and/or maintain local LAM procedures to assist in the embedment of IRM policies.
   2. Creating awareness through trainings.
   3. Induction training for all new to bank employees.
3. Accountability: 25 %
   1. Ensure that IRM policies and standards are embedded via performing regular snap checks and other 2nd level checks.
   2. Review access levels, JML processes and other user provisioning roles.
   3. Monitor Data management activities providing oversight to the business on data quality
4. Accountability: 20%
   1. Ensure that High critical applications are reviewed from a LAM perspective (access rights & security matrix are in place).
   2. Support record management across the business
5. Accountability: 15%
   1. Identifying applications gaps in relation to information risk and remediation following agreed actions with the business.
   2. Partake in new applications roll out to ensure it is complying with LAM policy requirements.

Technical skills / Competencies

Education and Experience Required:

1. A degree from a reputable learning institution.
2. Professionally Certified (e.g. in CRISC, CISM, CISA) or CISSP or similar certification.
3. Accredited in Information Management/Information Sciences of 5 years in Financial Services or related industry.
4. 4 years experience, preferably in IT Security and Risk management related role.
5. Experience fulfilling a consulting role.
6. Proven relationship with executive management and communication skills.
7. Extensive Microsoft office skills (Word, Excel, PowerPoint, etc.)
8. Reasonable understanding of the principles, practices, and techniques related to Information Risk Management.
9. Knowledge and understanding of the implications, to Absa, of the laws and regulations associated with Payment Card Industry, Data Security Services (PCI, DSS).
10. Knowledge of wider aspects of risk control, operations and processes.
11. Detailed understanding of the Risk assessment processes.
12. Experience of a consultancy working style (i.e. used to working collaboratively across the business – essential for undertaking the assessment roles)

Competencies:

1. Information Management
2. Experience of developing IRM Standards - Basic
3. Quality Focus - Competent
4. Implementation Management  - Competent
5. Influencing – Competent
6. Information Security - Expert
7. Understanding of compliance requirements relating to records retention – Competent
8. Experience of developing communication and training strategies – Competent
9. Understanding of records management technologies – Competent
10. Planning and organization – Competent
11. Problem solving – Competent
12. Detailed understanding of the principles, practices, and techniques related to Information Risk Management.
13. Technical Security background and experience of working on application developments
14. A good understanding of the issues faced with outsourcing to external vendors and experience of conducting vendor assessments.
15. Ability to influence senior management in relation to important Risk decisions.
16. Proven leadership, relationship management and communication skills

Knowledge, Expertise and Experience

• Have core information risk management, confidence and a willingness to deliver.
• Good communication skills.
• Highly motivated and able to coordinate multiple activities across various disciplines.
• Experience of working in a financial organization would be beneficial.
• Awareness of operational risk disciplines, key risk indicators relevant to information risk and a business-focused approach to controls is also beneficial.  However deep technical knowledge in any one discipline is not a requirement for this role.
• It is essential that the candidate has a resilient, flexible approach to work, as a pre-requisite for working effectively as part of Barclays Information Management team.
• He or she must be prepared to turn their hand to support other requirements if needed, while ensuring that the core IRM responsibilities are maintained.
• A proactive and hands-on approach is essential to demonstrate that the value that this role and function can add to our organization.

Education

Further Education and Training Certificate (FETC): Physical, Mathematical, Computer and Life Sciences (Required)