Information & Cyber Security Officer - BRAC Ghana Savings and Loans

BRAC Ghana Savings and Loans Ltd (BGSL) is a socially responsible for-profit organization, engaging people, especially women in sustainable economic and income-generating activities in Ghana. Our mission is to provide a range of financial services responsibly to people at the bottom of the pyramid. 

Job Summary

BGSL is seeking applications from competent, dynamic and self-motivated individuals to fill the following position: Information & Cyber Security Officer

PURPOSE

Information & Cyber Security Officer is responsible for driving all cybersecurity initiatives in the institution.

MAJOR RESPONSIBILITIES

• Contribute to formulating an institutional methodology for managing cyber and information security risks.
• Contribute to the development of the institution’s Cyber and Information Security policy and submission to Senior Management and Board for approval.
• Contribute to developing and updating specific and general work procedures for realizing the Company’s cyber and information security policy.
• Responsible for maintaining ongoing processes of cyber and information security risk assessment with the relevant institutional units, to analyze and assess:
  • the risk levels integral to the institution's technological and business activities.
  • the controls required to ensure systems integrity.
  • the level of residual risk and exposure to cyber and information security threats the institution is willing to accept in implementing these activities.
• Support the integrating and coordinating all institutional cyber and information security efforts, including oversight and control of all institutional units participating in these efforts.
• Contribute to creating a framework for receiving ongoing and ad-hoc reports from various institutional units.
• Responsible for initiating and conducting cyber and information security readiness exercises as follows:
  • at least quarterly exercises shall be staged to assess the ability of one or more institutional entities to deal with a cyber-attack; and
  • once a year, an exercise shall be undertaken to assess the preparation of the entire institution to withstand cyber-attacks.
• Coordinating cyber and information security activities, including joint exercises with business partners and service providers.
• Promoting cyber and information security awareness and training employees, suppliers, business partners and customers.
• Continuously learning and monitoring cyber and information security issues by identifying trends, methods and advanced developments in the field while gathering information about emerging attack techniques and ways of dealing with them.
• Support the formation of a Cyber-Incident Response Team.
• Responsible for analyzing cyber and information security incidents that have occurred in Ghana and worldwide, and assess their potential impact on the institution, as well as implement the relevant measures proposed.
• Contribute to developing metrics and indicators to assess the effectiveness of cyber and information security systems and procedures.
• Support in assessing regular and ad-hoc institutional cyber and information security controls.
• Responsible for drawing up annual and multiannual work plans, including budgeting, prioritization, and timetables for implementing the assessment processes.
• Preparing and submitting annual reports to the Senior Management and Board, detailing the institutional cyber and information security defense level, weaknesses and vulnerabilities, available countermeasures, and the activities and budgets required to enhance its defenses.
• Collaborating with relevant institutions involved in cyber and information security issues.
• Preparation of reports on major cyber and information security incidents to the Bank of Ghana.

Safeguarding responsibilities:

• Establish a safeguarding culture across all levels of the programme by implementing the safeguarding policy. Act as a key source of support, guidance and expertise on safeguarding for establishing a safe working environment.
• Responsible to ensure team members are appropriately trained, supported and have access to resources regarding issues that are identified and actioned in accordance with the safeguarding policy and procedure.
• Follow the safeguarding reporting procedure in case any reportable incident takes place, encourage others to do so.

Required Skills or Experience

EXPERIENCE (Including sector/industry)

• At least 5 years’ work experience in management of IT within a financial institution (preferably banking) or professional service firms
• Built and implemented a comprehensive cyber risk management framework, ISO
• Directed company-wide risk assessments, vulnerability management programs, and penetration testing cycles, improving security posture by measurable KPIs.
• Oversaw SOC operations, threat intelligence, incident response, reducing incident response time by 90%.
• Developed and tested Incident Response Plans, Disaster Recovery Plans, and Business Continuity Plans, improving resilience and recovery times.

KNOWLEDGE, SKILLS & COMPETENCIES

• Cybersecurity frameworks (ISO 27001, CIS Controls etc.)
• Network security, cloud security, endpoint security
• Identity & Access Management (IAM), Zero Trust Architecture
• Security operations (SIEM, SOC processes, incident handling)
• Cloud technologies (AWS, Azure, GCP security concepts)
• Vulnerability management and penetration testing fundamentals
• Business continuity & disaster recovery processes
• Perform risk assessments and define security controls

SPECIFIC EDUCATIONAL/PROFESSIONAL QUALIFICATION

• Degree/Masters
• Require at least a bachelor’s degree in a relevant field, such as Computer Science, Information Technology, or Engineering.
• ISO 27001 Lead Implementer, is an Advantage
• Concentration / Major: Computer Science, Information Technology, or Engineering.

🔥 SIMILAR JOBS YOU MAY LIKE → APPLY