Group IT Risk & Information Security Officer

Open Access Consulting

We are recruiting to fill the position below:

Job Title: Group IT Risk & Information Security Officer

Location: Victoria Island, Lagos

Employment Type: Full-time

Department: Enterprise Assurance

Reports To: Head, Enterprise Assurance

Job Description

• The Group IT Risk & Information Security Officer is responsible for providing independent oversight, assessment and monitoring of information technology, cybersecurity, information security and systems-related risks across Famous Holdings Limited and its subsidiaries.
• The role supports the effectiveness of the Group's Enterprise Risk Management, Internal Control and Internal Audit functions by evaluating the adequacy and effectiveness of IT governance, systems controls, cybersecurity safeguards, data protection, technology infrastructure and business continuity arrangements.
• The Officer shall provide specialist technical expertise in conducting IT risk assessments, reviewing IT general and application controls, evaluating critical business systems and technology initiatives, identifying vulnerabilities and control weaknesses, and monitoring compliance with applicable regulatory requirements, internal policies and recognised international standards, including relevant CBN and SEC requirements, the Nigeria Data Protection Act (NDPA), ISO/IEC 27001 and COBIT.
• The role shall also support IT and systems-related assurance reviews, technology risk reporting, incident assessments and remediation monitoring across the Group, while collaborating with Technology and other business functions to strengthen information security, operational resilience and the overall control environment.
• The position shall operate within Enterprise Assurance, maintaining independence from day-to-day IT operations and control implementation, while providing specialist support to Internal Audit without compromising its independent assurance responsibilities.

Responsibilities

• The Group IT Risk & Information Security Officer shall be responsible for the following functions across Famous Holdings Limited and its subsidiaries, working closely with Technology, Risk Management, Internal Control, Internal Audit and other relevant business functions.

IT Risk Management:

• Conduct periodic IT and technology risk assessments across the Group, covering IT infrastructure, business applications, digital platforms, networks, databases, cloud services and third-party technology arrangements.
• Identify, assess and monitor emerging technology risks, cybersecurity threats, system vulnerabilities and potential exposures affecting business operations.
• Develop, maintain and periodically update the Group IT Risk Register in alignment with the Group Enterprise Risk Management Framework and approved Risk Appetite.
• Establish and monitor relevant IT Key Risk Indicators (KRIs), risk thresholds and early-warning indicators, escalating material exposures and breaches as appropriate.
• Evaluate technology risks associated with new systems, digital transformation initiatives, system upgrades, technology projects and changes to existing business processes.
• Monitor implementation of agreed IT risk mitigation measures and report significant outstanding exposures to the Head, Enterprise Assurance.

Information Security and Cybersecurity Oversight:

• Assess the adequacy and effectiveness of information security and cybersecurity governance arrangements, policies, procedures and safeguards across the Group.
• Review cybersecurity controls covering network security, endpoint protection, firewalls, encryption, malware prevention, security monitoring and vulnerability management.
• Evaluate identity and access management arrangements, including privileged access, multi-factor authentication, user access rights and segregation of duties.
• Review vulnerability assessments, penetration testing reports, security assessments and other cybersecurity testing outcomes, and monitor remediation of identified weaknesses.
• Assess the adequacy of cybersecurity incident detection, reporting, response and recovery arrangements, including root-cause analysis and corrective actions.
• Monitor emerging cyber threats and security vulnerabilities and recommend appropriate risk mitigation and control improvements.
• Support information security awareness and cybersecurity risk sensitisation initiatives across the Group.

IT Controls and Compliance Monitoring:

• Evaluate the design and operating effectiveness of IT General Controls (ITGCs), including logical access, change management, IT operations, system development and backup controls.
• Review application controls relating to transaction processing, data input, validation, authorisation, completeness, accuracy and integrity of system-generated information.
• Conduct periodic IT control reviews and testing to identify control deficiencies, process weaknesses and non-compliance with approved policies and procedures.
• Assess the adequacy of controls over system administration, privileged activities, audit trails, system logs and monitoring of critical IT operations.
• Review controls over IT asset management, software licensing, configuration management and technology infrastructure.
• Maintain records of identified IT control exceptions and monitor the implementation and closure of agreed corrective actions.
• Recommend improvements to strengthen the Group's IT control environment and reduce operational, financial, regulatory and reputational exposures.

IT Systems Assurance and Technical Review Support:

• Provide specialist technical support to Enterprise Assurance in conducting IT and systems-related reviews, investigations and control assessments across the Group.
• Participate in reviews of core banking applications, financial systems, enterprise applications, payment platforms and other critical business systems to assess their reliability, security and control effectiveness.
• Support Internal Audit in planning and executing technology-related audit engagements, including ITGC reviews, application control assessments, system configuration reviews and technology risk evaluations.
• Assess the adequacy of system interfaces, automated controls, data integrity checks, exception reporting and system-generated management information.
• Review system implementation, migration, integration and upgrade activities to identify technology risks, control gaps and potential business disruptions.
• Provide technical input into investigations involving system irregularities, unauthorised transactions, suspected fraud, data breaches and other technology-related incidents.
• Prepare technical review reports, document findings and recommend practical corrective measures to address identified systems and control weaknesses.

Independence Requirement:

• Technical support to Internal Audit shall be provided in accordance with approved audit arrangements, without compromising Internal Audit's independence or responsibility for its assurance conclusions.

Regulatory Compliance and IT Governance:

• Monitor compliance with applicable information technology, cybersecurity, information security and data protection laws, regulations and regulatory directives relevant to the Group and its subsidiaries.
• Assess compliance with applicable CBN cybersecurity requirements, SEC regulations, the Nigeria Data Protection Act (NDPA) 2023 and other relevant regulatory requirements.
• Evaluate alignment with recognised IT governance and information security frameworks, including ISO/IEC 27001, COBIT and other applicable industry standards.
• Review the adequacy of IT governance policies, standards and procedures, including Information Security, Cybersecurity, Access Control, Change Management, Data Protection and IT Risk Management policies.
• Monitor regulatory developments affecting technology operations, cybersecurity, digital financial services and information security, and advise Management on their implications.
• Support regulatory examinations, compliance assessments and remediation of technology-related regulatory findings.
• Promote consistent IT governance and information security control standards across Group entities, taking into account subsidiary-specific regulatory obligations.

Third-Party Technology and Vendor Risk Management:

• Conduct IT risk and information security assessments of technology vendors, service providers, cloud platforms, outsourced IT arrangements and other relevant third parties.
• Evaluate the adequacy of security, confidentiality, data protection, service availability and business continuity arrangemen