Senior IT Risk Management Officer

Duty station: Addis Ababa (Head Office)

About the Organization:

VisionFund Micro Finance Institution (S.C) is an Institution established according to proclamation No. 40/96 to provide financial services to the productive poor in the rural and urban areas of Ethiopia. VisionFund is currently operating in five of the Regional States of the country. VisionFund MFI is currently looking candidates for the position of Programmer based at the Head Office. The successful candidates will have skills and experience that meet the following requirements:

 SPECIFIC DUTIES AND RESPONSIBILITIES

Establish, maintain, and independently oversee the comprehensive IT and Cybersecurity Risk Management Framework and overarching risk policies, while independently reviewing, challenging, and evaluating the operational standards, tools, and methodologies implemented by the first line.

• Independently evaluate and challenge the operational resilience of the Core Banking System (CBS) and digital delivery channels, assessing whether the first line of defence has implemented robust controls to mitigate technological and cyber risk exposures.
• Independently review, challenge, and monitor the IT change management process and major changes in hardware, applications, documentation, and business processes to ensure risk exposures are properly evaluated.
• Oversee, monitor, and challenge the execution of IT risk mitigation action plans implemented by the first line, ensuring robust second-line independent risk oversight without engaging in hands-on IT operations, system administration, or direct technical implementation.
• Independently oversee, review, and challenge the first line’s identification of IT threats, technical vulnerabilities, and mitigation strategies, as well as the execution of the IT/Cyber Incident Response framework and Business Continuity/Disaster Recovery (BCDR) protocols.
• Independently monitor, assess, and challenge institutional compliance and adherence to NBE directives, cybersecurity proclamations, data protection regulations, and internal IT policies.
• Design and oversee an independent risk assessment program that evaluates, measures, and reports on the reduction of information security risk relative to the MFI’s approved risk appetite.
• Collaborate on change initiatives to advise and challenge on the implementation of information security and general IT controls requirements.
• Facilitate, oversee, and aggregate the IT Risk and Control Self-Assessments (RCSA) and IT risk register, monitor Key Risk Indicators (KRIs) against approved risk appetite thresholds, and analyze risk scenarios to determine impact on business objectives.
• Collaborate with Internal Audit (the Third Line of Defence) and compliance functions to ensure audit findings and regulatory gaps related to IT and cybersecurity are tracked, independently validated, and remediated by the first line.
• Perform other related duties assigned by the supervisor.

QUALIFICATIONS, EXPERIENCE AND SKILL

 EDUCATION/TRAINING 

• Minimum BA/BSc Degree in Computer Science, Information Technology, Management Information Systems (MIS), or a related field, with recognized professional IT risk or security certifications (e.g., CRISC, CISA, CISM).

EXPERIENCE

• A minimum of 5 years of relevant experience, with at least 3 years in a dedicated second-line IT risk management, operational risk, or cybersecurity governance role within the regulated banking or financial services sector.

 TECHNICAL SKILLS & OTHER SKILLS

• Advanced knowledge of IT risk frameworks (e.g., ISO 27005, NIST, COBIT)
• Proficiency in cybersecurity controls and threat intelligence
• Comprehensive knowledge of National Bank of Ethiopia (NBE) directives regarding IT governance, cybersecurity frameworks, and risk management for financial institutions.
• Advanced data analysis (Excel/SQL/BI tools) for risk quantification, KRI tracking, and reporting
• Business continuity and disaster recovery planning
• Strong report writing and presentation skills for Board-level reporting.

1. Terms of employment: Permanent
2. Salary & Benefits: Attractive salary with benefit package
3. Closing Date: August 17, 2026