ICT Security Officer – UGAFODE Microfinance Limited

• Implement, maintain and monitor UGAFODE's cybersecurity systems.
• Participate in the design and implementation of current IT standards, policies, guidelines and appropriate security architecture principles.
• Ensure that the organization's IT security goals and objectives continue to be achieved.
• Support continuous improvement of UGAFODE's information security environment.
• Ensure security controls remain aligned with organizational requirements and industry best practices.

• Firewalls
• Data protection controls
• Log analyzers
• Endpoint security solutions
• Patch management
• Encryption controls
• Vulnerability scanning
• Penetration testing
• Security access controls

• Research, evaluate, design, test and recommend technology upgrades and improvements to the IT security environment.
• Plan major changes to the security environment where required.
• Analyze the potential impact of proposed changes on existing ICT systems.
• Oversee proper deployment, configuration and operation of security technologies.
• Ensure new security technologies are appropriately integrated into the existing ICT environment.

• Provide IT security awareness training to UGAFODE personnel.
• Deliver security awareness activities in accordance with established IT security training programmes.
• Promote good cybersecurity hygiene and responsible use of organizational ICT resources.
• Encourage employees to understand and comply with information security policies and procedures.

• Represent the department during IT security and operational audits.
• Support audits conducted by internal assurance functions and third-party assessors.
• Ensure UGAFODE maintains a strong information security posture.
• Monitor compliance with service-level agreements involving outsourced ICT security service providers.
• Support implementation and closure of audit recommendations.

• Enforce ICT change and incident management processes.
• Ensure change and incident management activities comply with approved IT policies.
• Support effective documentation and tracking of security incidents.
• Ensure security implications are appropriately considered before significant ICT changes are implemented.

• Work with ICT staff to identify and understand audit, risk, vulnerability and compliance findings.
• Ensure identified findings are addressed and closed within agreed timelines.
• Enforce day-to-day threat and vulnerability management activities.
• Identify appropriate risk tolerances.
• Recommend and support implementation of risk treatment plans.
• Monitor emerging cybersecurity threats and vulnerabilities.
• Support continuous improvement of the organization's security risk posture.

• Provide guidance during cybersecurity incidents and investigations.
• Support appropriate incident response activities.
• Ensure root-cause analysis is conducted following security incidents.
• Recommend appropriate approaches for addressing identified weaknesses.
• Capture lessons learned from security incidents and support implementation of corrective actions.

• Ensure systems and information comply with Uganda's Data Protection and Privacy Act, 2019 and other applicable legal and regulatory requirements.
• Monitor ICT security practices for compliance with relevant regulatory standards.
• Support implementation of appropriate data protection and privacy controls.
• Ensure security controls adequately protect organizational and customer information.

• Work with the IT team to ensure security considerations are incorporated into the evaluation, selection, installation and configuration of:
  • Hardware
  • Applications
  • Software
  • Network infrastructure
  • Third-party connections
• Ensure new technologies are introduced into the ICT environment in accordance with current security policies and standards.
• Assess security risks associated with third-party connections and technology deployments.

• Maintain a technical security knowledgebase.
• Maintain a technical reference library.
• Monitor and document security advisories and alerts.
• Maintain information on emerging security trends and practices.
• Keep records of relevant laws, regulations and security standards.
• Ensure relevant security information is accessible to appropriate ICT and management teams.

• Support the Head of Information Security in developing annual IT Security budgets.
• Support preparation of annual IT Security work plans.
• Participate in execution and monitoring of approved security budgets and work plans.
• Provide input into security technology and resource requirements.

• Undertake other assignments related to information systems technology as may be assigned by supervisors from time to time.
• Support broader ICT and information security initiatives as required by management.

• A minimum of a Bachelor's degree in Computer Science, Information Technology or another relevant field from a recognized university.
• Certification in Systems, Databases or Networks.
• Professional IT security certifications or training will be an added advantage.

• CISSP – Certified Information Systems Security Professional
• CEH – Certified Ethical Hacker
• CCSP – Certified Cloud Security Professional
• CISA – Certified Information Systems Auditor
• CISM – Certified Information Security Manager
• MCSE – Microsoft Certified Solutions Expert

• CCNA – Cisco Certified Network Associate
• CCNP – Cisco Certified Network Professional

• At least three (3) years' relevant experience in an organization of a similar nature.
• Experience in a financial institution, government institution, telecommunications organization or consulting firm is preferred.
• Experience conducting risk assessments, business impact assessments, control assessments and vulnerability assessments.
• Experience defining and implementing risk treatment strategies.
• Practical experience in information security, cybersecurity, ICT risk or related technical roles.

• Network Engineer
• Network Administrator
• Database Administrator
• Systems Analyst
• Applications Developer
• IT Auditor
• IT Risk Analyst
• Information Security Specialist
• Cybersecurity Analyst
• Systems Administrator

• UNIX operating systems
• Microsoft Server operating systems
• Virtualization technologies
• Intrusion Prevention Systems (IPS)
• Intrusion Detection Systems (IDS)
• Advanced enterprise networks
• LAN and WAN technologies
• Firewalls
• Endpoint security
• Vulnerability management
• Security monitoring
• Patch management
• Encryption
• Penetration testing
• Security architecture
• Risk assessment
• IT controls
• Data protection and privacy

• ISO 27001 / ISO 27002
• COBIT
• NIST
• PCI
• ISF Standards of Good Practice for Information Security

• Excellent analytical skills
• Strong cybersecurity knowledge
• Excellent problem-solving abilities
• Security risk assessment
• Vulnerability assessment
• IT security controls
• Security architecture
• Incident management
• Strong communication skills
• Excellent interpersonal skills
• Ability to influence and work with teams
• Attention to detail
• Ability to work independently
• Ability to analyze complex security requirements
• Ability to translate security requirements into appropriate security controls
• Strong understanding of regulatory compliance
• Continuous learning and awareness of emerging cybersecurity threats

• An application letter
• An up-to-date CV

• Cybersecurity and information security experience
• IT security systems administration
• Firewall management
• Endpoint security
• Vulnerability scanning and management
• Penetration testing
• Security risk assessments
• IT audits and compliance
• Incident response
• Security architecture
• Network security
• Microsoft Server and UNIX experience
• Data protection and privacy compliance
• ISO 27001, NIST or COBIT knowledge
• Professional cybersecurity certifications
• Experience in banking, microfinance, telecommunications, government or consulting environments