Information Security Officer – National Social Security Fund (NSSF)

The National Social Security Fund (NSSF) is positioning itself to be the Social Security Provider of Choice in Uganda. With our shared purpose of being the Social Security Provider of choice, providing exceptional customer service and better operations, with a workforce that is well motivated and skilled, we are looking to recruit people with high integrity and dedication to work with us.

JOB TITLE: INFORMATION SECURITY OFFICER

REPORTS TO: INFORMATION SECURITY MANAGER

POSITIONS: THREE

DEPARTMENT: RISK

DUTY STATION: KAMPALA, WORKERS HOUSE

**MAIN PURPOSE: **

The jobholder will be responsible for monitoring and assessing the Fund’s information assets to identify potential threats and risks, and recommend appropriate measures to ensure confidentiality, integrity and availability of data/information therein, to authorized users.

Duties and Responsibilities include:

• • Implement information security and privacy policies, standard and procedures to protect the Fund from internal and external threats
• • Review and assess information security risks within new and existing systems, processes, policies and procedures and recommend relevant controls.
• • Conduct continuous vulnerability assessments and regular penetration tests on the Funds systems
• • Create a culture of security awareness by undertaking sensitization/training of staff on information security and privacy risks and control.
• • Work with all key process and system owners to ensure security and data privacy controls are considered at the outset of new projects, products and initiatives.
• • Administer information security monitoring systems for incident detection, response, risk mitigation, and threat management.
• • Implement identity management and access control strategies, policies, procedures, standards, and guidelines.
• • Create, revoke and manage identities/access for personnel, service accounts, applications, devices etc.
• • Control and monitor access to the Funds information assets to identify unauthorized access and potential malicious activities
• • Conduct regular user access reviews in collaboration with system, process and data owners.
• • Conduct regular audit log reviews and report any unusual or suspicious activities.
• • Work with system and process owners to develop, implement and maintain access control lists and matrices
• • Configure, implement, and manage identity management and access control technologies and tools
• • Establish, administer, and monitor privileged user accounts in accordance with a role-based access scheme
• • Support the Data Protection Officer in conducting data privacy impact assessments
• • Ensure that the IT infrastructure and systems are configured with appropriate technical controls to safeguard them against malicious attacks
• • Monitor compliance with information security policies, guidelines and standards and applicable laws and regulations

Education Requirements:

1. University Degree in Information Technology or Information Systems or Computer Science or Software Engineering is a must.
2. Professional qualifications such as CEH, CISA or equivalent is a must

Related Job Experience:

• Minimum of 3-year experience in conducting IT risk or information security responsibilities in a substantial organization
• Experience in administering information security tools, identity management and access control systems is an added advantage.

Key Competences:

• • Strong understanding of information security risk, controls and principles
• • Sound knowledge of information security technologies e.g., WAF, NAC, SIEM, DLP, IAM, EDR
• • Understanding of Cloud technologies and the associated risks
• • Knowledge of networking protocols
• • Strong analytical, decision-making and problem-solving skills
• • Ability to explain complex security issues to non-technical stakeholders
• • Positive attitude towards learning and development
• • Ability to work with critical deadlines and prioritize workload effectively.
• • Knowledge of the Data Protection and Privacy Act and applicable regulations, National Information Security Framework, ISO 27001, NIST standards etc.

Interested individuals should send application letters, detailed CVs and copies of academic credentials to the Head of Human Resources & Administration at recruitment@nssfug.org by Wednesday 23rd February 2022, for registration and onward transmission. Please note that canvassing or lobbying will lead to automatic disqualification of the candidate