ICT Risk Officer, Risk & Compliance

Job Summary:

To identify, assess, monitor, and report ICT and technology risks across the organization. The ICT Risk Officer provides independent oversight of technology-related risks, ensuring that ICT risks are effectively managed in line with the organization’s risk appetite, regulatory requirements, and business objectives.

Key Responsibilities

ICT Risk Management

Develop and maintain the ICT risk management framework.

Conduct ICT risk assessments across systems, projects, infrastructure, and third-party service providers.

Maintain the ICT Risk Register and monitor risk treatment plans.

Assess emerging technology risks, including cloud, digital transformation, AI, and cyber risks.

Risk Monitoring and Reporting

Monitor Key Risk Indicators (KRIs) relating to ICT.

Prepare monthly, quarterly, and annual ICT risk reports.

Escalate significant technology risks to management and relevant committees.

Track and report risk mitigation actions.

Security Operations

Monitor the organization’s security posture and controls.

Investigate and manage information security incidents.

Review vulnerability assessments and remediation activities.

Monitor security tools such as SIEM, EDR, DLP, firewalls, and endpoint security solutions.

Governance and Compliance

Ensure compliance with regulatory requirements relating to technology risk.

Support risk reviews for new systems and projects.

Participate in business continuity and disaster recovery assessments.

Support internal and external audits relating to ICT risk.

Third-Party Risk Management

Assess technology risks associated with vendors and service providers.

Review ICT-related contractual and control requirements.

Monitor outsourced technology services for emerging risks.

Risk Awareness

Promote risk awareness across ICT and business functions.

Provide guidance on risk assessments and control effectiveness.

Key Performance Indicators (KPIs)

Percentage of ICT risks assessed and reviewed.

Closure rate of ICT risk mitigation actions.

Reduction in high-risk ICT findings.

Timeliness and quality of risk reports.

Regulatory compliance rating.

Qualifications

Bachelor’s Degree in Information Technology, Computer Science, Information Systems, Risk Management, or related field.

Professional certification such as:

CRISC

CISA

CGEIT

ISO 31000 Risk Management

CISSP

Experience

Over 3 years’ experience in ICT Risk, Technology Audit, IT Governance, or Enterprise Risk Management.

Experience in regulated industries is desirable.

Competencies

Risk assessment and analysis.

Governance and regulatory compliance.

Technology risk management.

Report writing and communication.

Stakeholder management.

Minimum qualifications

BA/BSc/HND

How to apply

If you meet the above requirements and wish to be part of our vibrant team in Risk and Compliance Department, please send your application letter and updated CV to the email address careers@gakenya.com by 6th November 2026. Indicate the position you are applying for on the email subject line. Only shortlisted candidates

Similar open roles

• Compliance OfficerBank of Africa Kenya Limited · Nairobi
• Head - Controls & GovernanceKCB Bank Kenya · Nairobi
• Assistant Privacy, Risk and Compliance Officer | TP KenyaTeleperformance Kenya · Nairobi
• Risk and Compliance OfficerMater Misericordiae Hospital · Nairobi
• Senior Manager, Compliance & Data PrivacyNCBA Group · Nairobi
• Assistant Risk and Compliance OfficerWorld Vision Kenya · Nairobi