About the job
A GLIMPSE ABOUT CRÉDIT AGRICOLE EGYPT:
Crédit Agricole Egypt Since its launch in 2006, Crédit Agricole Egypt has succeeded to become a strong player on the economic scene, positioning itself as the Reference European Bank in Egypt. Aiming to become a leading innovation-driven sustainable bank, Crédit Agricole Egypt is committed to bring its international expertise to the local market to serve its clients and drive the sustainable development in line with Egypt’s national priorities.
With a universal customer-focused model, Crédit Agricole Egypt is “a whole bank just for you” serving the entire spectrum of customers: individuals, SMEs, enterprises, Corporate and public sector. Prioritizing its customers’ best interests, Crédit Agricole Egypt presents an extensive range of services, tailored financial solutions and the sound advice, to accompany its clients in their walk of life. Awarded most innovative bank in Egypt, convenience and distinguished customer experience is Crédit Agricole Egypt’s endeavor to attain its customers’ satisfaction throughout its nationwide network of branches and its state-of-the-art fully-fledged platform of digital services. Furthermore, Crédit Agricole Egypt is in line with the world’s digital transformation, encouraging and implementing an innovative environment to exceed its customers’ expectations.
In addition, for being an active contributor to the local economy, the bank is committed to support the development of the Egyptian community and the respect of the environment.
Duties & responsibilities:
- Support managing InfoSec & User authorization unit teams to safeguard CAE’s technical assets via policies and control environment covering security awareness, risk management, policy compliance, regular controls, ongoing InfoSec approvals, etc. and follow-up all team assignments establishing KPIs to measure results (e.g., # approvals/day, response time, etc.)
- Approve CAE’s users access over different CAE’s application and systems
- Support in directing and approving security decisions
- Manage ad-hoc requests raised by management, business, IT, etc. and follow-up with InfoSec & BCM team members fulfilling those requests.
- Act as Secretary of IT Security Committee.
- Advise, provide guidance and support to top management decision making on information security matters.
- Validating all bank InfoSec policies/programs, develop and maintain information security related policies, guidelines and the information security permanent control assessment.
- Ensure following up after CBE instructions such as CBE alerts, execute CBE InfoSec recommendations, ensure fulfilling CBE audit recommendations, present CBE-related dashboards in ITSecCom (e.g., CBE alerts dashboard, etc.).
- Represent Information Security function in project steering committees, regular meetings with IT, Risk, business, operations, etc.
- Develop/enhance information security related policies and documents (including concept, development, obtaining stakeholder buy-in)
- Follow-up management decision over IT activities
- Ensure different security standards and Group IS policies are translated into process and departmental procedures reflecting compliance to the latest IS procedures development. Recommend improvements to security controls applied to operating systems, network and security equipment’s.
- Collect and consolidate key performance indicators (KPIs) related to all information security activities from the relevant InfoSec team to develop comprehensive performance dashboards for senior management.
- Lead the process of risk analysis for new projects and threats starting from identifying security requirements during RFP phase, till evaluating the proposed controls and provide opinion and security recommendations over all received MESARI documents.
- Control the risk analysis process via monthly Key Risk Indicator (KRI) over projects missing simplified/detailed MESARI based on project dashboard provided by IT Gov./PMO as well as establish team KPI for responding to MESARI requests.
- Manage InfoSec team preparing security reporting (e.g., KPIs, security dashboards, etc.) and provide reporting on the risk and compliance status to Senior Management.
- Manage CAE Security awareness program including training, regular tips, tests & exercises (Phishing simulation, cyber-crisis Management exercise, etc.) and provide results to management with corrective action plan.
- Advise and assist ISS Projects & give advice for obtaining compliance with information security related rules
- Ensure complete compliance to Information security procedures in terms of information exchange with external third party either electronically or physically thus ensuring provision of adequate information security procedure to maintain confidentiality and integrity of information or physical documents
- Ensure all new projects involving acquisition of new systems/platforms or changes in documentation management flow are supporting relevant information security procedures on access control, audit trail generation of both admin and critical function level as well as proper encryption capability or dual custody storage of restricted or confidential information.
- Respond to security incidents and breaches.
- Lead, coordinate and design the test scenarios of cyber-crisis Management Exercise (CRIME)
- Oversee all security programs (Group or local) such as PANAM, CCU, CARS, HAB, Limited PCI-DSS, etc.
Main Requirments:
- 9+ years of experience in Information Security, IT Risk, or IT Governance.
- At least 2 years of experience in User Access Management or Identity & Access Management (IAM).
- Experience in managing access control, authorization processes, and information security compliance.
- Previous experience in the banking or financial services sector is preferred.
- Strong understanding of Information Security principles, policies, and procedures.
- Good knowledge of Identity & Access Management (IAM) and Role-Based Access Control (RBAC).
- Understanding of IT General Controls (ITGC), access reviews, and segregation of duties (SoD).
- Knowledge of regulatory requirements and information security standards (ISO 27001, NIST, etc.).
- Familiarity with IT audit requirements and risk assessment.
