Manager, IS Governance /GRC & IS Program Delivery

Job Summary
The Bank is seeking a Senior Candidate in Information Security Management to lead the information security
governance program for Equity Bank Rwanda by establishing and maintaining the policies, standards, oversight
mechanisms, risk reporting and compliance practices required to manage cybersecurity risk. The role ensures that
security governance is aligned with business objectives, regulatory obligations, Group requirements, and recognized
information security standards.
Key Responsibilities and Accountability.
• Develop, maintain and coordinate approval of the information security governance framework, policies,
standards, procedures and supporting control requirements.
• Lead the information security strategy and annual program planning process and monitor delivery against
approved objectives, risk priorities and budgets.
• Coordinate cybersecurity risk assessments, control self-assessments, risk treatment plans, exceptions and formal
risk acceptance processes.
• Maintain an accurate information security risk register and ensure material risks are assigned, treated, monitored
and escalated through the appropriate governance forums.
• Define and report meaningful KPIs, KRIs, KCIs, compliance status, program performance and significant
security issues to management and Board-level committees.
• Coordinate compliance with applicable BNR, Rwanda NCSA, data-protection, ISO/IEC 27001, PCI DSS and
other contractual or regulatory security obligations.
• Manage the ISMS governance lifecycle, including scope, objectives, control ownership, Statement of
Applicability, internal review, management review and continual improvement.
• Coordinate internal audit, external audit, regulatory examination and certification activities and track findings
and corrective actions to closure.
• Establish and maintain security governance forums, decision logs, reporting calendars, terms of reference and
accountability matrices.
• Oversee third-party information security governance, including risk classification, security due diligence,
contractual control requirements, periodic review and issue escalation.
• Coordinate policy awareness, role-based security training and governance communications and monitor
completion and effectiveness.
• Review projects, products and changes from a governance and risk perspective and ensure required security
assessments and approvals are completed.
• Monitor the external threat, regulatory and standards landscape and initiate timely updates to policies, controls
and risk treatment priorities.
• Support data governance, information classification, privacy, identity governance, incident governance and
business continuity interfaces with relevant control owners.
• Lead and develop governance personnel and promote clear accountability across security, risk, technology and
business functions.
• Perform any other responsibilities assigned by the line manager.
Additional skills required\:
• Strong governance, risk and compliance capability, including policy development, control oversight, risk
reporting, audit coordination and executive-level communication.
• Excellent stakeholder engagement, analytical writing, facilitation and program-management skills, with the ability
to translate regulatory and security requirements into practical business controls.