From the employer's careers page · Verified employer
Senior Officer – Information Systems Audit
Sidian Bank
Job at a glance
- Employer
- Sidian Bank
- Position
- Senior Officer – Information Systems Audit
- Location
- Kenya
- Possible duty stations
- Kenya
- Experience
- 3+ years in IS audit, risk, forensics, security
- Education
- Bachelor’s degree in IT or Computer Science
- Salary
- Not stated in the advert
- Application deadline
- Open until filled (listed until 18 October 2026)
- Posted on VacancyKE
- 30 September 2026
VacancyKE summary
Sidian Bank is hiring a Senior Officer – Information Systems Audit in Kenya. You will provide independent assurance on IT governance, risk management, and internal controls, leading complex audit assignments aligned with CBK guidelines and global standards.
What stands out about this opportunity
- Focuses on IT governance and cyber-risk assurance
- Requires hands-on execution of penetration tests
- Aligns with Global Internal Audit Standards (GIAS)
Key responsibilities
- Lead risk-based planning for audits by analyzing enterprise risks and regulatory expectations.
- Review core banking systems, payment platforms, IT infrastructure, and cybersecurity controls.
- Conduct vulnerability assessments, penetration tests, and evaluate incident response mechanisms.
- Assess vendor management processes, BCM frameworks, and disaster recovery testing.
- Script continuous audit reports using CAATs and perform forensic reviews as directed.
- Prepare high-impact audit reports articulating issues, root causes, and practical recommendations.
- Present findings to senior management and track remediation of management action plans.
- Test compliance with CBK guidelines, laws, and internal policies while challenging risk assessments.
Who should apply?
This job suits an experienced IT auditor with strong technical skills in cybersecurity and banking regulations who holds a mandatory CISA certification.
Key requirements
- CISA certification (mandatory)
- Bachelor’s degree in IT/Computer Science
- 3+ years IS audit/risk/security experience
- Knowledge of CBK Prudential Guidelines
- Proficiency in CAATs/data analytics
Nice to have
- CISM, CEH, or ISO 27001 Lead Auditor certifications.
- Experience specifically within the banking sector.
What you should know
- The role requires adherence to Global Internal Audit Standards (GIAS) and ISACA guidelines.
- You must maintain up-to-date knowledge on emerging ICT risks and regulations.
- Applications are submitted via Sidian Bank's official channels.
How to apply
Official source: From the employer's careers page · sidianbank.co.ke. VacancyKE never charges job seekers.
Original employer advertisement
Published by Sidian Bank on sidianbank.co.ke. Shown for reference; the employer’s version is the official one.
The employer’s advert
Senior Officer – Information Systems Audit
JOB PURPOSE
The job holder will provide an independent, objective assurance on the adequacy and effectiveness of the bank’s IT governance, risk management, compliance, and internal control environment. He/she will lead and oversee the planning, execution, reporting, and follow-up of complex audit assignments in line with Information Technology Assurance Frameworks(ITAF) and Standards, CBK Prudential Guidelines, and the bank’s policies and internal audit methodology.
KEY RESPONSIBILITIES
Audit Planning
• Lead comprehensive, risk-based planning for assigned audits by analyzing enterprise risks, regulatory expectations, historical audit results, emerging risks, and strategic priorities.
• Define audit objectives, scope, and detailed test procedures that directly address inherent, residual, and emerging risks, ensuring alignment with the annual audit plan.
• Conduct in-depth process understanding through system walkthroughs, Logs analysis, policy reviews, and stakeholder interviews to identify control gaps or vulnerabilities early.
• Determine the appropriate audit approach, sampling methodology, nature, timing, and extent of testing using risk-based and data-driven criteria.
Audit Execution
• Review core banking systems, payment platforms and IT infrastructure controls.
• Conduct vulnerability assessments and penetration tests.
• Assess cybersecurity controls, access management and incident response.
• Evaluate IT governance, policies, and regulatory compliance.
• Evaluate vendor management processes, including IT service provider oversight, contract compliance, and SLA performance.
• Review the Bank’s Business Continuity Management (BCM) framework, including disaster recovery testing.
• Perform audits in accordance with Global Internal Audit Standards (GIAS) and ISACA guidelines.
• Provide Quality assurance on ICT projects before Go-Live.
• Script and schedule continuous audit reports by use of CAATs.
• Conduct forensic reviews from time to time where need arises as directed by Head Of Internal Audit.
• Perform all other related duties as assigned from time to time
Audit Reporting, Monitoring & Follow-Up
• Prepare high-impact, concise, and well-supported audit reports that clearly articulate issues, underlying root causes, associated risks, and practical recommendations.
• Present audit findings confidently to departmental heads, senior management, and governance committees where required.
• Track and monitor management action plans, validate remediation, and perform follow-up reviews to ensure the effectiveness and sustainability of corrective actions.
Risk & Compliance
• Provide independent and objective assurance on the effectiveness of the bank’s IT risk management, compliance, and governance frameworks.
• Evaluate the adequacy and operating effectiveness of controls in key risk areas and across risk types (Cyber security, Access Controls, Business continuity and System related AML risks).
• Review and challenge the quality, completeness, and accuracy of risk assessments, KRIs, RCSAs, and mitigation plans developed by business units and second-line functions.
• Test compliance with relevant laws, regulatory requirements, CBK guidelines, internal policies, and industry best practices.
• Document and escalate control weaknesses, non-compliance, unethical conduct, and emerging risks promptly and in accordance with escalation protocols.
• Provide advisory insight on new regulatory developments and business initiatives while preserving audit independence.
• Maintain up-to-date professional knowledge on emerging ICT risks.
DECISION MAKING AUTHORITY
• Determine the audit approach, depth of testing, and sampling strategies for assigned engagements based on risk assessment and professional judgment.
• Evaluate the adequacy and effectiveness of internal controls and assign issue ratings consistent with the bank’s methodology and regulatory expectations.
• Recommend improvements and control enhancements aligned with business realities and regulatory requirements.
• Escalate material risks, control failures, fraud indicators, or non-compliance without delay.
• Exercise sound judgment in balancing audit rigor, business impact, and operational practicality.
ACADEMIC BACKGROUND
• Bachelor’s degree in IT, Computer Science, or related field.
• Minimum of 3 years’ experience in IS audit, risk, forensics and security preferably in banking.
WORK EXPERIENCE
• Minimum of three (3) years’ experience in IS audit, risk, forensics and security preferably in banking
• Proven exposure to ICT banking operations audits and regulatory compliance requirements.
• Experience in using audit management systems and data analytics tools.
SKILLS & COMPETENCIES
• Advanced analytical, critical thinking, and problem-solving capabilities.
• Strong report-writing and communication skills with the ability to articulate complex issues clearly.
• High professional skepticism, attention to detail, and ability to challenge status quo effectively.
PROFESSIONAL CERTIFICATION
• CISA certification (mandatory); CISM, CEH, or ISO 27001 Lead Auditor an advantage.
Application Form
Position Applying For: Senior Officer – Information Systems Audit
JOB PURPOSE
The job holder will provide an independent, objective assurance on the adequacy and effectiveness of the bank’s IT governance, risk management, compliance, and internal control environment. He/she will lead and oversee the planning, execution, reporting, and follow-up of complex audit assignments in line with Information Technology Assurance Frameworks(ITAF) and Standards, CBK Prudential Guidelines, and the bank’s policies and internal audit methodology.
KEY RESPONSIBILITIES
Audit Planning
• Lead comprehensive, risk-based planning for assigned audits by analyzing enterprise risks, regulatory expectations, historical audit results, emerging risks, and strategic priorities.
• Define audit objectives, scope, and detailed test procedures that directly address inherent, residual, and emerging risks, ensuring alignment with the annual audit plan.
• Conduct in-depth process understanding through system walkthroughs, Logs analysis, policy reviews, and stakeholder interviews to identify control gaps or vulnerabilities early.
• Determine the appropriate audit approach, sampling methodology, nature, timing, and extent of testing using risk-based and data-driven criteria.
Audit Execution
• Review core banking systems, payment platforms and IT infrastructure controls.
• Conduct vulnerability assessments and penetration tests.
• Assess cybersecurity controls, access management and incident response.
• Evaluate IT governance, policies, and regulatory compliance.
• Evaluate vendor management processes, including IT service provider oversight, contract compliance, and SLA performance.
• Review the Bank’s Business Continuity Management (BCM) framework, including disaster recovery testing.
• Perform audits in accordance with Global Internal Audit Standards (GIAS) and ISACA guidelines.
• Provide Quality assurance on ICT projects before Go-Live.
• Script and schedule continuous audit reports by use of CAATs.
• Conduct forensic reviews from time to time where need arises as directed by Head Of Internal Audit.
• Perform all other related duties as assigned from time to time
Audit Reporting, Monitoring & Follow-Up
• Prepare high-impact, concise, and well-supported audit reports that clearly articulate issues, underlying root causes, associated risks, and practical recommendations.
• Present audit findings confidently to departmental heads, senior management, and governance committees where required.
• Track and monitor management action plans, validate remediation, and perform follow-up reviews to ensure the effectiveness and sustainability of corrective actions.
Risk & Compliance
• Provide independent and objective assurance on the effectiveness of the bank’s IT risk management, compliance, and governance frameworks.
• Evaluate the adequacy and operating effectiveness of controls in key risk areas and across risk types (Cyber security, Access Controls, Business continuity and System related AML risks).
• Review and challenge the quality, completeness, and accuracy of risk assessments, KRIs, RCSAs, and mitigation plans developed by business units and second-line functions.
• Test compliance with relevant laws, regulatory requirements, CBK guidelines, internal policies, and industry best practices.
• Document and escalate control weaknesses, non-compliance, unethical conduct, and emerging risks promptly and in accordance with escalation protocols.
• Provide advisory insight on new regulatory developments and business initiatives while preserving audit independence.
• Maintain up-to-date professional knowledge on emerging ICT risks.
DECISION MAKING AUTHORITY
• Determine the audit approach, depth of testing, and sampling strategies for assigned engagements based on risk assessment and professional judgment.
• Evaluate the adequacy and effectiveness of internal controls and assign issue ratings consistent with the bank’s methodology and regulatory expectations.
• Recommend improvements and control enhancements aligned with business realities and regulatory requirements.
• Escalate material risks, control failures, fraud indicators, or non-compliance without delay.
• Exercise sound judgment in balancing audit rigor, business impact, and operational practicality.
ACADEMIC BACKGROUND
• Bachelor’s degree in IT, Computer Science, or related field.
• Minimum of 3 years’ experience in IS audit, risk, forensics and security preferably in banking.
WORK EXPERIENCE
• Minimum of three (3) years’ experience in IS audit, risk, forensics and security preferably in banking
• Proven exposure to ICT banking operations audits and regulatory compliance requirements.
• Experience in using audit management systems and data analytics tools.
SKILLS & COMPETENCIES
• Advanced analytical, critical thinking, and problem-solving capabilities.
• Strong report-writing and communication skills with the ability to articulate complex issues clearly.
• High professional skepticism, attention to detail, and ability to challenge status quo effectively.
PROFESSIONAL CERTIFICATION
• CISA certification (mandatory); CISM, CEH, or ISO 27001 Lead Auditor an advantage.
Application Form
Position Applying For: Senior Officer – Information Systems Audit