Position Overview

Zanaco Bank Plc is inviting applications from suitably qualified and experienced individuals for the following job aimed at contributing to the Bank's strategic vision, in the Information Technology Division under the IT Security at Head Office - Support Functions:

Role Description

This role is responsible for safeguarding the Bank’s digital assets, information, and systems from various cyber threats and attacks. The safeguards include, but not limited to Data Loss prevention, Vulnerability Assessments and Penetration Testing (VAPT), Network Security, Endpoint Security, Mobile Device Management, Email Security, Database Security, Cyber threat intelligence, Security in projects implementation. The role focuses on ensuring that adequate Security Controls, Cyber Risk Management and Compliance is applied and monitored across the enterprise in all IT related projects, systems, automated processes, and people involved in running automated process. The role enforces all security policies, procedures, and control objectives to mitigate risks to the Bank.

Reporting to the Cybersecurity & Threat Intelligence Senior Specialist, the Cybersecurity Specialist executes his/ her roles and responsibilities in close collaboration with the IT Function to ensure that controls are implemented and effectively monitored ensuring no conflict of interest exists.

Requirements

Cyber Security

• Security Architecture Design: Collaborate with the IT function to design and implement secure bank network and system architectures. This includes selecting appropriate security technologies and integrating them into the Bank’s infrastructure.
• Vulnerability Assessment and Penetration Testing: Regularly assess the bank’s IT infrastructure for vulnerabilities and ensure prompt remediations are carried out by the relevant IT Function teams.
• Working with business and support functions to ensure correct implementation of IT control requirements on various processes.
• Implementation and management of the Bank’s Public Key Infrastructure (PKI).
• Collaboration with Fraud Risk function to conduct digital forensic investigations.
• Spearhead the implementation and monitoring of advanced security controls ensuring no conflict of interest in management of implemented controls to ensure availability, integrity, and confidentiality of data.
• Offer continuous assurance in the deployment and maintenance of native IT Security controls such as intrusion detection/ prevention systems, firewalls to ensure availability, integrity, and confidentiality of data.
• Oversight, planning and execution of any required independent cybersecurity assessments and audits.
• Ensure compliance activities and reports associated with regulatory requirements are maintained.
• Involvement in arranging staff training in security awareness skills.
• Research, evaluate, and recommend new security technologies, processes, and methodologies.
• Participate in the implementation of an IT cyber-security strategy and proactively identify cyber-security threats.
• Applying information security foundations to complex network architectures
• Cyber Threat Intelligence: Monitor cyber threat intelligence sources to understand emerging threats and adapt security measures accordingly.
• Threat modelling: Identify and enumerate potential threats, such as structural vulnerabilities or the absence of appropriate safeguards, to recommend and communicate prioritized countermeasures for implementation by appropriate teams.

Security Operations Centre

• Threat Detection: Monitor the bank’s network, systems, and applications to identify and analyse potential security threats and vulnerabilities.
• Cyber Incident Management: Lead the cyber incident management efforts in the event of a security breach or cyberattack by investigating the incident, assessing the extent of the damage, taking steps to mitigate the impact, documenting all relevant details, including the incident's cause, impact, and steps taken for remediation.
• Work closely with third party managed security services providers (MSSPs) to ensure bank is protected on a 24/7 basis.

Risk Management

• Conduct Information Security Risk and Controls Self Assessments
• Maintain up to date Information Security Risk Registers
• Responsible for maintaining an up-to-date understanding of emerging trends in information security risks.
• Support for timely reporting of all IT risk events ensuring that root cause analysis is conducted.
• Responsible for monitoring control effectiveness where there are material risks of process control failure.

Audit and Compliance Management

• Supports the coordination of internal and external information security assessments by internal and external partners.
• Supports the tracking and closure of internal and external assessment issues.
• Make recommendations for action plans addressing management commitments.

ONLY SHORTLISTED APPLICANTS WILL BE COMMUNICATED TO.

Zanaco provides equal opportunity in employment for all qualified persons and prohibits discrimination in employment (women are encouraged to apply).

• Collaborate with the IT function to design and implement secure bank network and system architectures.
• Regularly assess the bank’s IT infrastructure for vulnerabilities and ensure prompt remediations are carried out.
• Ensure correct implementation of IT control requirements on various processes.
• Implement and manage the Bank’s Public Key Infrastructure (PKI).
• Collaborate with Fraud Risk function to conduct digital forensic investigations.
• Spearhead the implementation and monitoring of advanced security controls.
• Offer continuous assurance in the deployment and maintenance of native IT Security controls.
• Oversight, planning and execution of any required independent cybersecurity assessments and audits.
• Ensure compliance activities and reports associated with regulatory requirements are maintained.
• Involvement in arranging staff training in security awareness skills.
• Research, evaluate, and recommend new security technologies, processes, and methodologies.
• Participate in the implementation of an IT cyber-security strategy and proactively identify cyber-security threats.
• Applying information security foundations to complex network architectures.
• Monitor cyber threat intelligence sources to understand emerging threats and adapt security measures accordingly.
• Identify and enumerate potential threats, recommend and communicate prioritized countermeasures.
• Monitor the bank’s network, systems, and applications to identify and analyse potential security threats and vulnerabilities.
• Lead the cyber incident management efforts in the event of a security breach or cyberattack.
• Work closely with third party managed security services providers (MSSPs).
• Conduct Information Security Risk and Controls Self Assessments.
• Maintain up to date Information Security Risk Registers.
• Maintain an up-to-date understanding of emerging trends in information security risks.
• Support for timely reporting of all IT risk events.
• Monitor control effectiveness where there are material risks of process control failure.
• Support the coordination of internal and external information security assessments.
• Support the tracking and closure of internal and external assessment issues.
• Make recommendations for action plans addressing management commitments.

• Data Loss Prevention
• Vulnerability Assessments and Penetration Testing (VAPT)
• Network Security
• Endpoint Security
• Mobile Device Management
• Email Security
• Database Security
• Cyber Threat Intelligence
• Security in projects implementation
• Security Controls
• Cyber Risk Management
• Compliance
• Security Architecture Design
• Public Key Infrastructure (PKI) management
• Digital Forensic Investigations
• Intrusion Detection/Prevention Systems
• Firewalls
• Cybersecurity Assessments and Audits
• Security Awareness Training
• Threat Modelling
• Threat Detection
• Cyber Incident Management
• Information Security Risk and Controls Self Assessments
• Information Security Risk Registers maintenance
• IT Risk Event Reporting
• Control Effectiveness Monitoring
• Coordination of assessments
• Tracking and closure of assessment issues

• Experience in Cybersecurity & Threat Intelligence
• Experience in IT Security
• Experience in Data Loss Prevention
• Experience in Vulnerability Assessments and Penetration Testing (VAPT)
• Experience in Network Security
• Experience in Endpoint Security
• Experience in Mobile Device Management
• Experience in Email Security
• Experience in Database Security
• Experience in Cyber Threat Intelligence
• Experience in Security in projects implementation
• Experience in Security Controls
• Experience in Cyber Risk Management
• Experience in Compliance
• Experience in Security Architecture Design
• Experience in Public Key Infrastructure (PKI) management
• Experience in Digital Forensic Investigations
• Experience with Intrusion Detection/Prevention Systems
• Experience with Firewalls
• Experience in Cybersecurity Assessments and Audits
• Experience in Security Awareness Training
• Experience in Threat Modelling
• Experience in Threat Detection
• Experience in Cyber Incident Management
• Experience in Information Security Risk and Controls Self Assessments
• Experience in Information Security Risk Registers maintenance
• Experience in IT Risk Event Reporting
• Experience in Control Effectiveness Monitoring
• Experience in coordinating assessments
• Experience in tracking and closure of assessment issues