IT Risk Officer

Yako Bank was incorporated in 2010 and began operating as a deposit-taking microfinance institution (Yako Microfinance Uganda Ltd) in September 2015. In 2020, the institution was upgraded and licensed by the Bank of Uganda as a Tier II Credit Institution under the name Yako Bank Uganda Limited, taking over the financial services business of its predecessor microfinance arm. Today, Yako Bank is a fully-fledged credit institution serving a growing clientele through a network of four branches in Kampala and Jinja. The Bank offers a variety of products and services including savings accounts, term deposits, collateralized and non-collateralized loans, and basic mobile banking services to its target markets—SMEs, salaried individuals, micro-entrepreneurs, and smallholder farmers.

Role of the Job

Responsible for identifying, assessing, monitoring and reporting on Information Technology, cybersecurity and information security risks across Yako Bank. The job entails providing independent oversight of the Bank’s ICT environment, testing IT controls, overseeing IT incident, business continuity and third-party risks, and reporting to Risk Manager, while ensuring compliance with the Bank’s Risk Management Framework, Bank of Uganda requirements and applicable laws.

Key Result Areas

• Identify, assess, document and monitor Information Technology (IT), cyber and information security risks across the Bank’s systems, processes, projects and branches, and maintain an up-to-date IT risk register.

• Conduct IT Risk and Control Self-Assessments (RCSAs) and carry out risk assessments of new systems, products, digital channels and major IT changes before they are introduced into the ICT environment.

• Test the design and operating effectiveness of key IT controls, including access management, change management, backups, patching and segregation of duties, and carry out periodic user access reviews on the core banking and other critical systems.

• Monitor the Bank’s cybersecurity posture, including vulnerability assessment and penetration test results, and track remediation of identified weaknesses to closure.

• Ensure that IT and cyber incidents are logged, assessed, escalated and reported in line with the Bank’s Incident Management Policy and regulatory timelines, and lead root-cause analysis of significant incidents.

• Review the Bank’s Business Continuity and Disaster Recovery plans, participate in Disaster Recovery tests, and report on results, gaps and recovery objectives for critical systems.

• Assess and monitor risks arising from IT vendors, cloud and outsourced service providers before onboarding and periodically thereafter, including enforcement of service-level agreements.