Main Purpose of the Job

The main purpose of the role is to be accountable for implementing and operationalizing ASA Zambia’s information security controls, coordinating security operations activities (monitoring, vulnerability management, incident response), supporting audits and regulatory engagements, and driving a measurable security posture across head office and branches—aligned to ASA International Group baselines and legal/regulatory requirements.

Key Responsibilities

• Implement information security policies, standards and minimum baselines, including procedures and Standard Operating Procedures for core security processes.
• Maintain an exception/risk acceptance workflow for deviations from baseline, ensuring approvals, compensating controls, and expiry tracking.
• Conduct periodic security risk assessments (including branch coverage) and maintain the information security risk register.
• Produce information security KRIs/KPIs and dashboards and provide standardized reporting inputs through Head Risk and Compliance towards the Group-led initiatives and reporting.
• Coordinate Security Operations Center (SOC)/Security Information and Event Management (SIEM) onboarding and monitoring requirements with the Group SOC capability; ensure log sources, alert tuning inputs, and local response readiness.
• Lead local incident triage and coordination: containment, evidence preservation, root cause analysis, remediation tracking, post-incident reporting
• Manage the vulnerability lifecycle: scanning coordination, risk-weighted prioritization, remediation tracking, validation, and reporting (including audit evidence).
• Oversee periodic user access reviews against approved access matrices; track gaps and closures.
• Support and implement Group privileged access principles locally.
• Participate in vendor due diligence and third-party security reviews, ensuring contracts and service arrangements meet ASA requirements.
• Track third-party remediation actions and maintain evidence for audits and regulators.
• Support testing and maintenance of disaster recovery and business continuity security requirements (e.g., resilience controls, recovery testing evidence)
• Execute information security awareness programs for staff and branches; deliver targeted training for high-risk roles.

Key Performance Measures

Stakeholders:

• Engagements with internal business functions.
• Engagements with regulators which include the Data Protection Commission.

Employees:

• Effective engagement with all staff
• Employee development through information security awareness programs

Risk Management:

• Implementation of IT Risk Control Self-Assessment.

Compliance and Reporting:

• Monthly reports submitted to Head Risk & Compliance.
• Existence of adequate cyber-security controls and measures.

Strategy:

• Aligning information security goals with broader organizational objectives.

Key Skills, Knowledge, Experience and Core Competencies

Skills:

• Excellent analytical, problem-solving, and communication skills.
• Strong organizational and project management skills
• Good communication skills.
• Good decision-making, problem-solving, and presentation skills.

Knowledge:

• SIEM/logging concepts and alert triage
• Vulnerability management and patch governance
• Endpoint and network security controls (EDR/AV, firewalls, segmentation concepts)
• Identity and access management, access review execution, privileged access governance concepts
• Disaster Recovery/Business Continuity Plan testing support and evidence readiness
• Strong knowledge and understanding of the Bank of Zambia cyber security risk directives.

Experience and Qualifications:

• Bachelor’s degree in information technology, Computer Science, Information Systems, or equivalent.
• Desirable certifications: CISA / CISM / CISSP / ISO 27001 LI/LA / Security+ / CEH
• 5 to 8 years’ experience in IT / Security, with 3–5 years in an information security / IT risk / security operations role.
• Demonstrated experience in at least three of: security operations, incident response, vulnerability management, IAM/access reviews, endpoint security, network security controls, audit/compliance evidence management.
• Exposure in the financial services sector highly preferred.

Core Competencies:

• Capabilities to develop policies and standard operating procedures.
• Ability to collaborate with stakeholders at all levels.
• Ability to work in an entrepreneurial, multicultural, multidisciplinary team and deliver high-quality work within deadlines to meet objectives.
• High proficiency level in verbal and written English

Important Relationships

• Foster strong relationships with Departmental Heads and functional heads.
• Foster good working relationships with regulatory bodies such as the Bank of Zambia.

Problem Solving, Planning and Decision Making

Problem Solving:

• Ability to proactively identify and resolve risks associated with information security.

Planning:

• Ability to develop action plans and methodologies to manage information security risks.
• Ability to organize work in order of importance and priority.

Decision Making:

• Ability to provide objective guidance without undue influence.

We stand for diversity and inclusion. Therefore, we warmly encourage everyone to apply, regardless of gender, background, ethnicity, age, religion, etc.

“ASA Microfinance Zambia limited aims to attract and select a diverse workforce, ensuring equal opportunity to everyone, irrespective race, age, gender, class ethnicity, disability, location, and religion. Qualified women are particularly encouraged to apply”.

• Implement information security policies, standards and minimum baselines, including procedures and Standard Operating Procedures for core security processes.
• Maintain an exception/risk acceptance workflow for deviations from baseline, ensuring approvals, compensating controls, and expiry tracking.
• Conduct periodic security risk assessments (including branch coverage) and maintain the information security risk register.
• Produce information security KRIs/KPIs and dashboards and provide standardized reporting inputs through Head Risk and Compliance towards the Group-led initiatives and reporting.
• Coordinate Security Operations Center (SOC)/Security Information and Event Management (SIEM) onboarding and monitoring requirements with the Group SOC capability; ensure log sources, alert tuning inputs, and local response readiness.
• Lead local incident triage and coordination: containment, evidence preservation, root cause analysis, remediation tracking, post-incident reporting
• Manage the vulnerability lifecycle: scanning coordination, risk-weighted prioritization, remediation tracking, validation, and reporting (including audit evidence).
• Oversee periodic user access reviews against approved access matrices; track gaps and closures.
• Support and implement Group privileged access principles locally.
• Participate in vendor due diligence and third-party security reviews, ensuring contracts and service arrangements meet ASA requirements.
• Track third-party remediation actions and maintain evidence for audits and regulators.
• Support testing and maintenance of disaster recovery and business continuity security requirements (e.g., resilience controls, recovery testing evidence)
• Execute information security awareness programs for staff and branches; deliver targeted training for high-risk roles.

• Excellent analytical, problem-solving, and communication skills.
• Strong organizational and project management skills
• Good communication skills.
• Good decision-making, problem-solving, and presentation skills.
• SIEM/logging concepts and alert triage
• Vulnerability management and patch governance
• Endpoint and network security controls (EDR/AV, firewalls, segmentation concepts)
• Identity and access management, access review execution, privileged access governance concepts
• Disaster Recovery/Business Continuity Plan testing support and evidence readiness
• Strong knowledge and understanding of the Bank of Zambia cyber security risk directives.

• Bachelor’s degree in information technology, Computer Science, Information Systems, or equivalent.
• Desirable certifications: CISA / CISM / CISSP / ISO 27001 LI/LA / Security+ / CEH
• 5 to 8 years’ experience in IT / Security, with 3–5 years in an information security / IT risk / security operations role.
• Demonstrated experience in at least three of: security operations, incident response, vulnerability management, IAM/access reviews, endpoint security, network security controls, audit/compliance evidence management.
• Exposure in the financial services sector highly preferred.