Group IT Risk and Information Security Officer

Open Access Consulting is a professional services firm dedicated to delivering strategic solutions in human capital development, expatriate and immigration services, recruitment, background check services, value-added consulting, and outsourcing services

We are recruiting to fill the position below:

Job Title: Group IT Risk & Information Security Officer 

Location: Victoria Island, Lagos
Employment Type: Full-time
Department: Enterprise Assurance
Reports To: Head, Enterprise Assurance

Job Description

• The Group IT Risk & Information Security Officer is responsible for providing independent oversight, assessment and monitoring of information technology, cybersecurity, information security and systems-related risks across Famous Holdings Limited and its subsidiaries.
• The role supports the effectiveness of the Group's Enterprise Risk Management, Internal Control and Internal Audit functions by evaluating the adequacy and effectiveness of IT governance, systems controls, cybersecurity safeguards, data protection, technology infrastructure and business continuity arrangements.
• The Officer shall provide specialist technical expertise in conducting IT risk assessments, reviewing IT general and application controls, evaluating critical business systems and technology initiatives, identifying vulnerabilities and control weaknesses, and monitoring compliance with applicable regulatory requirements, internal policies and recognised international standards, including relevant CBN and SEC requirements, the Nigeria Data Protection Act (NDPA), ISO/IEC 27001 and COBIT.
• The role shall also support IT and systems-related assurance reviews, technology risk reporting, incident assessments and remediation monitoring across the Group, while collaborating with Technology and other business functions to strengthen information security, operational resilience and the overall control environment.
• The position shall operate within Enterprise Assurance, maintaining independence from day-to-day IT operations and control implementation, while providing specialist support to Internal Audit without compromising its independent assurance responsibilities.

Responsibilities

• The Group IT Risk & Information Security Officer shall be responsible for the following functions across Famous Holdings Limited and its subsidiaries, working closely with Technology, Risk Management, Internal Control, Internal Audit and other relevant business functions.

IT Risk Management:

• Conduct periodic IT and technology risk assessments across the Group, covering IT infrastructure, business applications, digital platforms, networks, databases, cloud services and third-party technology arrangements.
• Identify, assess and monitor emerging technology risks, cybersecurity threats, system vulnerabilities and potential exposures affecting business operations.
• Develop, maintain and periodically update the Group IT Risk Register in alignment with the Group Enterprise Risk Management Framework and approved Risk Appetite.
• Establish and monitor relevant IT Key Risk Indicators (KRIs), risk thresholds and early-warning indicators, escalating material exposures and breaches as appropriate.
• Evaluate technology risks associated with new systems, digital transformation initiatives, system upgrades, technology projects and changes to existing business processes.
• Monitor implementation of agreed IT risk mitigation measures and report significant outstanding exposures to the Head, Enterprise Assurance.

Information Security and Cybersecurity Oversight:

• Assess the adequacy and effectiveness of information security and cybersecurity governance arrangements, policies, procedures and safeguards across the Group.
• Review cybersecurity controls covering network security, endpoint protection, firewalls, encryption, malware prevention, security monitoring and vulnerability management.
• Evaluate identity and access management arrangements, including privileged access, multi-factor authentication, user access rights and segregation of duties.
• Review vulnerability assessments, penetration testing reports, security assessments and other cybersecurity testing outcomes, and monitor remediation of identified weaknesses.
• Assess the adequacy of cybersecurity incident detection, reporting, response and recovery arrangements, including root-cause analysis and corrective actions.
• Monitor emerging cyber threats and security vulnerabilities and recommend appropriate risk mitigation and control improvements.
• Support information security awareness and cybersecurity risk sensitisation initiatives across the Group.

IT Controls and Compliance Monitoring:

• Evaluate the design and operating effectiveness of IT General Controls (ITGCs), including logical access, change management, IT operations, system development and backup controls.
• Review application controls relating to transaction processing, data input, validation, authorisation, completeness, accuracy and integrity of system-generated information.
• Conduct periodic IT control reviews and testing to identify control deficiencies, process weaknesses and non-compliance with approved policies and procedures.
• Assess the adequacy of controls over system administration, privileged activities, audit trails, system logs and monitoring of critical IT operations.
• Review controls over IT asset management, software licensing, configuration management and technology infrastructure.
• Maintain records of identified IT control exceptions and monitor the implementation and closure of agreed corrective actions.
• Recommend improvements to strengthen the Group's IT control environment and reduce operational, financial, regulatory and reputational exposures.

IT Systems Assurance and Technical Review Support:

• Provide specialist technical support to Enterprise Assurance in conducting IT and systems-related reviews, investigations and control assessments across the Group.
• Participate in reviews of core banking applications, financial systems, enterprise applications, payment platforms and other critical business systems to assess their reliability, security and control effectiveness.
• Support Internal Audit in planning and executing technology-related audit engagements, including ITGC reviews, application control assessments, system configuration reviews and technology risk evaluations.
• Assess the adequacy of system interfaces, automated controls, data integrity checks, exception reporting and system-generated management information.
• Review system implementation, migration, integration and upgrade activities to identify technology risks, control gaps and potential business disruptions.
• Provide technical input into investigations involving system irregularities, unauthorised transactions, suspected fraud, data breaches and other technology-related incidents.
• Prepare technical review reports, document findings and recommend practical corrective measures to address identified systems and control weaknesses.

Independence Requirement:

• Technical support to Internal Audit shall be provided in accordance with approved audit arrangements, without compromising Internal Audit's independence or responsibility for its assurance conclusions.

Regulatory Compliance and IT Governance:

• Monitor compliance with applicable information technology, cybersecurity, information security and data protection laws, regulations and regulatory directives relevant to the Group and its subsidiaries.
• Assess compliance with applicable CBN cybersecurity requirements, SEC regulations, the Nigeria Data Protection Act (NDPA) 2023 and other relevant regulatory requirements.
• Evaluate alignment with recognised IT governance and information security frameworks, including ISO/IEC 27001, COBIT and other applicable industry standards.
• Review the adequacy of IT governance policies, standards and procedures, including Information Security, Cybersecurity, Access Control, Change Management, Data Protection and IT Risk Management policies.
• Monitor regulatory developments affecting technology operations, cybersecurity, digital financial services and information security, and advise Management on their implications.
• Support regulatory examinations, compliance assessments and remediation of technology-related regulatory findings.
• Promote consistent IT governance and information security control standards across Group entities, taking into account subsidiary-specific regulatory obligations.

Third-Party Technology and Vendor Risk Management:

• Conduct IT risk and information security assessments of technology vendors, service providers, cloud platforms, outsourced IT arrangements and other relevant third parties.
• Evaluate the adequacy of security, confidentiality, data protection, service availability and business continuity arrangements maintained by technology service providers.
• Review compliance with technology-related Service Level Agreements (SLAs), contractual security obligations and applicable regulatory outsourcing requirements.
• Identify and monitor risks arising from third-party technology dependencies, outsourced systems and concentration of critical technology services.
• Monitor remediation of identified third-party technology and information security risks.

Business Continuity, Disaster Recovery and Technology Resilience:

• Assess the adequacy of IT-related business continuity, disaster recovery and technology resilience arrangements across the Group.
• Review backup procedures, data recovery arrangements, disaster recovery infrastructure and recovery capabilities for critical systems.
• Participate in business continuity and disaster recovery testing exercises to evaluate preparedness and identify control deficiencies.
• Assess the adequacy of recovery time objectives (RTOs), recovery point objectives (RPOs) and system availability arrangements for critical business applications.
• Monitor implementation of corrective actions arising from disaster recovery tests, system outages and technology-related business disruptions.

IT Incident Management and Remediation Monitoring:

• Review and assess reported IT, cybersecurity, information security and systems-related incidents to determine their risk implications and potential impact on the Group.
• Support independent investigations into significant technology incidents, including system failures, security breaches, unauthorised access and technology-related control failures.
• Maintain a consolidated register of material IT risk incidents, control exceptions and agreed remediation actions.
• Monitor root-cause analysis, corrective action plans and remediation timelines to ensure identified weaknesses are adequately addressed.
• Escalate significant incidents, recurring control failures and overdue high-risk remediation actions to the Head, Enterprise Assurance.

Risk Reporting, Management Advisory and Stakeholder Engagement:

• Prepare periodic IT risk, information security and systems assurance reports for the Head, Enterprise Assurance and relevant Management and Board Committees.
• Develop and maintain IT risk and control dashboards covering cybersecurity exposures, control deficiencies, regulatory compliance, incidents, KRIs and remediation status.
• Provide independent risk and control advisory support to Management on technology initiatives, information security matters and systems-related operational risks.
• Collaborate with Group Technology, subsidiary IT teams, Risk Management, Internal Control, Internal Audit and other stakeholders to promote effective IT governance and control practices.
• Provide technical input into the Group Enterprise Risk Register, assurance reports and other management information relating to technology and information security risks.
• Perform other IT risk, information security and systems assurance-related responsibilities as may be assigned by the Head, Enterprise Assurance, consistent with the role's mandate and independence requirements.

Key Performance Indicator (KPI)

• The performance of the Group IT Risk & Information Security Officer shall be assessed against the following indicators, with emphasis on the effectiveness of IT risk oversight, information security, systems assurance, regulatory compliance and timely remediation of identified control weaknesses across Famous Holdings Limited and its subsidiaries.

S/N Key Performance Indicator (KPI) Performance Measure:

• IT Risk Assessment Coverage Percentage of planned IT and cybersecurity risk assessments completed within approved timelines.
• IT Risk Register Management Timeliness, completeness and accuracy of updates to the Group IT Risk Register, including identification and escalation of material risks.
• IT Controls Review and Testing Percentage of planned IT General Controls (ITGCs), application controls and systems control reviews completed within approved timelines.
• Systems Assurance Support Timely completion and quality of assigned IT systems reviews, technical assessments and specialist support provided to Enterprise Assurance functions.
• Information Security and Cybersecurity Oversight Percentage of scheduled cybersecurity control assessments completed and material vulnerabilities appropriately reported and escalated.
• Regulatory and Policy Compliance Percentage of planned IT regulatory compliance assessments completed and identified non-compliance issues reported within prescribed timelines.
• IT Control Deficiency Remediation Monitoring Percentage of high-risk IT control deficiencies and cybersecurity vulnerabilities monitored, escalated where overdue, and independently validated following reported remediation within agreed timelines.
• Technology Incident Oversight Timeliness of assessment, reporting, escalation and follow-up of significant IT and cybersecurity incidents.
• Third-Party Technology Risk Assessment Percentage of planned technology vendor and outsourced service provider risk assessments completed within agreed timelines.
• Business Continuity and Disaster Recovery Oversight Percentage of scheduled IT business continuity and disaster recovery assessments completed, with identified gaps reported and tracked to resolution.
• IT Risk Reporting and Escalation Timeliness, accuracy and quality of periodic IT risk, cybersecurity, systems assurance and control reports submitted to Management.
• Stakeholder Engagement and Advisory Support Timeliness and quality of technical risk advisory support provided to Technology, business functions and Group subsidiaries.

Qualification  & Experience 
Educational Qualifications:

• A minimum of a Bachelor's degree (B.Sc./B.Tech./B.Eng.) or equivalent qualification in Computer Science, Information Technology, Information Systems, Cybersecurity, Computer Engineering or a related discipline from a recognised institution.
• A postgraduate degree in Information Security, Cybersecurity, Information Systems, IT Governance, Risk Management or a related field will be an added advantage.

Professional Experience:

• A minimum of five (5) years of relevant professional experience in IT Risk Management, Information Security, IT Audit, IT Controls, Cybersecurity or Technology Governance, preferably within a financial institution, fintech, financial services group or other regulated environment.
• Demonstrable experience in conducting IT risk assessments, evaluating IT General Controls (ITGCs), reviewing application controls and assessing the effectiveness of information security arrangements.
• Practical experience in IT systems reviews, technology-related assurance engagements, systems implementation reviews and assessment of critical business applications.
• Working knowledge of cybersecurity risk management, vulnerability assessments, penetration testing, identity and access management, incident management and technology resilience.
• Experience in reviewing core banking applications, financial systems, payment platforms, enterprise applications or other technology-enabled business processes will be an added advantage.
• Familiarity with applicable regulatory requirements, particularly CBN cybersecurity and IT risk management requirements, SEC regulations, the Nigeria Data Protection Act (NDPA) and recognised IT governance and information security frameworks.
• Experience in preparing IT risk reports, maintaining IT Risk Registers, monitoring Key Risk Indicators (KRIs) and tracking remediation of identified control weaknesses.
• Demonstrated ability to work collaboratively with Technology, Risk Management, Internal Control, Internal Audit and other business functions while maintaining appropriate professional independence.

Preferred Professional Certifications:

• Possession of at least one of the following internationally recognised professional certifications is desirable:
• Certification Relevance to the Role
• Certified in Risk and Information Systems Control (CRISC) – ISACA IT risk identification, assessment, monitoring and control
• Certified Information Systems Auditor (CISA) – ISACA IT auditing, systems assurance and evaluation of IT controls
• Certified Information Security Manager (CISM) – ISACA Information security governance, risk management and security programme oversight
• Certified Information Systems Security Professional (CISSP) – ISC2 Cybersecurity architecture, security controls and information security management
• ISO/IEC 27001 Lead Auditor or Lead Implementer Information Security Management Systems, compliance assessments and security governance
• Additional relevant certifications in COBIT, cloud security, cybersecurity, data protection or IT governance will be an added advantage.

Other Requirements:

• Sound understanding of the financial services operating environment, including technology risks associated with regulated financial institutions and Group-wide technology arrangements.
• Strong analytical, problem-solving and technical assessment capabilities, with the ability to identify material technology risks and recommend practical control improvements.
• Ability to interpret technical IT and cybersecurity matters and communicate their business implications effectively to Management and other non-technical stakeholders.
• Proficiency in preparing risk assessments, control review reports, technical findings and management presentations.
• High standards of integrity, confidentiality, professional judgement and independence in the discharge of assurance responsibilities.

Competency Profile:
Technical Competencies:

• IT Governance and Risk Management: Strong knowledge of IT governance frameworks, technology risk assessment methodologies, risk registers, Key Risk Indicators (KRIs) and enterprise risk management principles.
• Information Security and Cybersecurity: Sound understanding of cybersecurity principles, information security controls, threat and vulnerability management, security monitoring, incident response and cyber risk mitigation.
• IT Controls and Systems Assurance: Proficiency in evaluating IT General Controls (ITGCs), application controls, automated controls, system configurations, audit trails, data integrity and technology-related control environments.
• IT Audit and Control Testing: Practical knowledge of IT audit methodologies, risk-based control assessments, audit testing techniques, documentation of findings and remediation validation.
• Systems and Application Security: Ability to assess security and control arrangements relating to core banking applications, financial systems, enterprise applications, databases, cloud platforms and other critical business systems.
• Identity and Access Management: Knowledge of logical access controls, privileged access management, multi-factor authentication, segregation of duties and user access administration.
• Regulatory Compliance and Data Protection: Working knowledge of applicable CBN and SEC technology-related requirements, the Nigeria Data Protection Act (NDPA), ISO/IEC 27001, COBIT and relevant information security standards.
• Technology and Third-Party Risk Management: Ability to evaluate technology projects, system implementations, IT outsourcing arrangements, cloud services, vendor security controls and associated operational risks.
• Business Continuity and IT Resilience: Understanding of business continuity management, disaster recovery planning, backup and recovery controls, system availability and technology resilience assessments.
• Risk Reporting and Technical Analysis: Proficiency in analysing technology risks, interpreting technical findings, developing IT risk dashboards and preparing clear risk, control and assurance reports for Management.

Behavioral Competencies:

• Analytical Thinking and Problem-Solving: Ability to critically evaluate complex technology issues, identify underlying risks and recommend practical solutions.
• Integrity and Professional Independence: Demonstrates high ethical standards, objectivity, confidentiality and sound professional judgement in performing oversight and assurance responsibilities.
• Attention to Detail: Ability to identify control weaknesses, system anomalies, inconsistencies and potential security vulnerabilities through thorough assessment.
• Communication and Reporting: Strong written and verbal communication skills, with the ability to present technical risks and findings clearly to both technical and non-technical stakeholders.
• Stakeholder Management and Collaboration: Ability to work effectively with Technology, Risk Management, Internal Control, Internal Audit, business units and subsidiary management while maintaining professional independence.
• Proactiveness and Risk Awareness: Demonstrates initiative in identifying emerging technology risks, anticipating control weaknesses and recommending preventive measures.
• Critical Thinking and Constructive Challenge: Ability to independently assess existing practices, challenge control deficiencies professionally and provide objective recommendations.
• Planning and Organisational Skills: Ability to manage multiple assignments, prioritise risk-based reviews, meet reporting deadlines and monitor outstanding remediation actions.
• Adaptability and Continuous Learning: Willingness to remain abreast of evolving cybersecurity threats, emerging technologies, regulatory developments and industry best practices.
• Accountability and Results Orientation: Demonstrates ownership of assigned responsibilities, commitment to quality and timely delivery of agreed objectives.