Information Security Officer

Purpose of the Role

The Information Security Officer is responsible for protecting the Bank's information assets, systems, networks, applications, customer information, and digital banking environment against cybersecurity threats and unauthorized access. From time to time, the role may be required to undertake additional tasks and frequency that may not be specified in this description.

Key Accountabilities

Information Security Governance

·       Develop and maintain information security policies, standards, and procedures.

·       Establish appropriate information-security controls.

·       Maintain information-security documentation.

·       Monitor compliance with approved security policies.

Cybersecurity Monitoring

·       Monitor security events and potential cybersecurity incidents.

·       Coordinate investigation and response to security incidents.

·       Identify vulnerabilities and security weaknesses.

·       Coordinate vulnerability assessments and security testing.

·       Recommend appropriate security controls.

Access Management

·       Monitor user access to critical systems.

·       Ensure appropriate access approval and segregation of duties.

·       Review privileged and administrative accounts.

·       Conduct periodic access reviews.

Digital Banking Security

·       Monitor security controls for digital banking systems.

·       Coordinate with IT and technology vendors regarding security requirements.

·       Review system changes from an information-security perspective.

·       Participate in application and infrastructure security assessments.

Incident Response

·       Maintain information-security incident response procedures.

·       Coordinate investigation of security incidents.

·       Document security incidents and corrective actions.

·       Conduct post-incident reviews.

·       Recommend preventive measures to reduce recurrence.

Security Awareness

·       Develop employee cybersecurity awareness programs.

·       Conduct information-security training.

·       Promote secure handling of customer and Bank information.

·       Monitor compliance with security practices.

Risk and Compliance

·       Coordinate with Risk, Compliance, Internal Audit, and IT.

·       Assist in information-security risk assessments.

·       Support regulatory examinations and audits.

·       Monitor resolution of security-related audit findings.