Officer, Digital Financial Services & Project Risks at Sidian Bank

JOB PURPOSE

The job holder will assist in providing continuous, independent 2nd line assurance on the Bank’s Digital Financial Services (DFS) Control and project risks undertaken by the bank. The role delivers objective oversight on control design and operating effectiveness across Digital Financial Services channels, Digital Lending platforms, Merchant Acquiring, and Data Lake pipelines & Projects. The role holder will also ensure that all Digital Financial Services, operational and systems risks across Bank platforms are managed in strict compliance with internal policies, CBK & ODPC guidelines.

KEY RESPONSIBILITIES:

• Governance and Regulatory Compliance
• IT Risk and Data Impact Assessment
• Business Continuity and Disaster Recovery Coordination
• Systems Monitoring and Control Review
• Incident and Breach Management
• Reporting

GOVERNANCE AND REGULATORY COMPLIANCE

• Maintain 2nd Line governance oversight ensuring all digital banking operations, credit scoring algorithms, and data processing architectures comply with CBK guidelines, statutory limits, and ODPC regulatory requirements. 
• Collaborate with the Data Privacy Officer to ensure DFS data flows, processing activities, and Data Lake ingestion pipelines align with statutory requirements under the Kenya DPA 2019 & regulations. 
• Provide objective 2nd Line oversight and challenge on the design and operational effectiveness of control systems and workflows across all DFS channels. 
• Validate that all approved products are supported by end-to-end standard operating procedures (SOPs), workflow routines, and dual-authorization control frameworks signed off by all relevant stakeholders prior to launch.

IT RISK AND DATA IMPACT ASSESSMENT

• Coordinate directly with the ERM, IT Risk Officer to evaluate technical vulnerabilities, system change management requests, API security controls, and Privileged Access Management (PAM) across the bank’s DFS systems and projects.
• Review risk profiles and control baselines for new feature deployments, digital lending engines, third-party integrations, and Data Lake ingestion controls prior to production go-live. 
• Review technical documentation for products involving DFS products and projects (i.e. solution architecture, process and data flow diagrams) for comprehensive risk identification an controls design effectiveness reviews.
• Track the remediation of technical control gaps, vulnerability assessment items, and any red-teaming test findings to final closure on DFS and Projects. 

BUSINESS CONTINUITY AND DISASTER RECOVERY COORDINATION

• Oversee BCP and Disaster Recovery (DR) readiness for critical digital channels (Mobile Banking, Internet Banking, USSD, Merchant, Digital Lending engines, and Data Lake feeds). 
• Participate in periodic BCP/DR failover tests, assessing operational resilience, recovery time objectives (RTO), and recovery point objectives (RPO) during simulated switchover events for DFS projects. 
• Validate that failback routines, offline processing queues, and manual reconciliation procedures during system outages maintain strict accounting controls and data integrity. 

SYSTEMS MONITORING AND CONTROL REVIEW

• Digital Lending Controls – Monitor loan scoring parameters, automated approval thresholds, disbursement limits, and write-off reconciliation routines including review of controls around use of AI in DFS products. 
• Merchant Acquiring Controls – Review merchant transaction limits, merchant float reconciliations, fee splits, and chargeback handling; review merchant settlement controls, chargeback/reversal workflows, transaction limits, and interchange fee collection routines across merchant acquiring deployment & other controls e.g. on automated credit scoring parameters, AI controls in DFS deployments. 
• Develop and monitor DFS control metrics, project risk indicators, and operational KRI’s, and assist in the development of breach thresholds. 
• Ensure all DFS and project risks are comprehensively captured and tracked through the business RCSA. 
• Perform independent control tests and validate both design adequacy and operational effectiveness of controls. 

INCIDENT AND BREACH MANAGEMENT

• Review and evaluate the effectiveness of automated monitoring systems with independent sample testing of the implemented DFS controls/rule exceptions and override queues to ensure digital fraud and operational failures are promptly detected and remediated by 1st Line teams. 
• Support the investigation, logging, and root-cause analysis of digital transaction failures, payment outages, and privacy breaches in coordination with the Data Protection & Privacy Officer. 
• Track incident remediation action plans, ensuring 1st Line operational teams resolve underlying system flaws to prevent recurring outages or losses. 

REPORTING

• Formulate and maintain and report on Key Risk Indicators (KRIs) on CSA) for DFS solutions, Digital Lending, Merchant Acquiring, and Data Lake operations & Projects
• Prepare comprehensive 2nd Line risk and control performance dashboards for IT Risk, BCP & Data Privacy for Senior Management & Board Risk Reports on DFS and projects.

ACADEMIC BACKGROUND

• Bachelor’s degree in Information Technology, Computer science, business, or related fields.
• Strong knowledge of Information Security related frameworks/ Regulations/such as, ISO 27001, NIST 800-53 or other leading industry certifications e.g. CompTIA Security +, CEH, CISA.
• At least 5 years of Banking or Information Technology Experience with exposure to Digital Financial Services (DFS) & Projects.
• Knowledgeable in IT operations, IT Controls, IT Risk, IT Audit & Project Management.
• Knowledge on Data Protection laws & General Data Protection Regulations (GDPR)/Kenya Data Protection Act, 2019 & Regulations, CBK guidelines.

SKILLS & COMPETENCIES

• Excellent interpersonal & Communication Skills
• Working in Teams
• Excellent analytical skills
• Problem solving skills
• Excellent knowledge of security tools
• Report writing skills

PROFESSIONAL CERTIFICATION

• Professional qualifications such as Certified Information Systems Security Professional CISA, Certified Information Systems Security Professional CISM or Certified Information Systems Security Professional (CISSP).