CRDB Bank PLC: Senior Manager Cyber Governance, Risk & Compliance Job Vacancy

CRDB Bank PLC is seeking a highly skilled and experienced Senior Manager Cyber Governance, Risk & Compliance to join their team at the Tanzania Head Office. This is a full-time position with a competitive salary and benefits.

Job Purpose

The Senior Manager Cyber Governance, Risk & Compliance will provide strategic leadership and oversight of the Bank’s cybersecurity governance, risk management, regulatory compliance, assurance, cybersecurity strategy, performance management and reporting. The role is responsible for establishing and maintaining the governance framework through which cybersecurity policies, accountability, risk appetite, regulatory requirements, control expectations and management oversight are defined across the Bank and its subsidiaries. The successful candidate will lead the identification, assessment, treatment, monitoring and reporting of cybersecurity risks while providing management with assurance on the effectiveness of cybersecurity controls and compliance with applicable regulatory, legal and industry requirements. The role will also oversee cybersecurity governance and awareness programmes, ensuring that policies, standards, management expectations and security culture remain aligned with business objectives, the Bank’s risk profile and regulatory environment. Additionally, the Senior Manager will support the Head of Cybersecurity in translating the Bank’s cybersecurity vision into an actionable strategy and roadmap, while providing consolidated reporting on cybersecurity performance, risk, compliance, maturity, strategic initiatives and investment.

Principal Responsibilities

1. Cybersecurity Strategy and Leadership

• Develop and monitor the implementation of the cybersecurity strategy, operating model, roadmap and annual priorities in alignment with the Bank’s corporate strategy, business objectives and risk priorities.
• Support the Head of Cybersecurity in translating the Bank’s cybersecurity vision into an actionable strategy, strategic roadmap, annual priorities and measurable outcomes.
• Provide strategic leadership and direction to Cybersecurity Governance, Cybersecurity Risk & Assurance, and Cybersecurity Strategy & Reporting.
• Ensure clear accountabilities and effective coordination across the cybersecurity function.
• Maintain oversight of cybersecurity programmes and initiatives, ensuring progress, strategic dependencies, delivery risks and material constraints are visible to management.

2. Cybersecurity Governance and Policy Management

• Establish and maintain an effective cybersecurity governance framework defining accountability, oversight, decision-making, escalation and reporting arrangements.
• Advise the Head of Cybersecurity and senior management on material cyber risks, regulatory developments, governance matters, control weaknesses and other issues requiring management attention.
• Oversee the Bank’s cybersecurity policies and standards framework, ensuring it remains current, risk-based, enforceable and aligned with regulatory and business requirements.
• Maintain senior management oversight of material cybersecurity policy exceptions, control deviations and significant non-compliance.
• Ensure appropriate risk acceptance and escalation arrangements are maintained.
• Establish effective governance structures for cybersecurity decisions, management oversight and accountability across the Bank and relevant subsidiaries.

3. Cybersecurity Risk Management and Assurance

• Support the establishment and monitoring of cybersecurity risk appetite, tolerance levels and Key Risk Indicators (KRIs).
• Ensure material cybersecurity exposures outside approved thresholds receive appropriate management attention.
• Ensure accountable risk owners establish effective treatment plans for material cyber risks.
• Challenge and escalate significant overdue or inadequate remediation.
• Establish and oversee a risk-based cybersecurity assurance programme to provide management with confidence in the adequacy and effectiveness of key cybersecurity controls.
• Coordinate cybersecurity-related internal audits, external audits, regulatory reviews and independent assessments.
• Ensure material cybersecurity risks, control deficiencies and audit issues are appropriately monitored and addressed.

4. Regulatory Compliance and Standards

• Provide strategic oversight of the Bank’s cybersecurity regulatory and compliance obligations.
• Ensure applicable regulatory requirements are identified, understood and incorporated into cybersecurity governance and control arrangements.
• Maintain management oversight of compliance with applicable regulatory requirements and cybersecurity frameworks, including:
  • ISO/IEC 27001
  • PCI DSS
  • Other cybersecurity requirements adopted by or applicable to the Bank.

5. Cybersecurity Performance Management and Reporting

• Establish an integrated cybersecurity performance framework incorporating KPIs, KRIs, maturity measures and other indicators for assessing cybersecurity performance and risk.
• Ensure accurate, high-quality and decision-oriented cybersecurity reports are provided to senior management, Executive Management, Board committees and other relevant governance forums.
• Monitor cybersecurity strategic investments and budget performance.
• Escalate significant constraints or budget variances that may affect the delivery of cybersecurity priorities.
• Ensure progress, risks and performance of cybersecurity initiatives are appropriately reported.

6. Cybersecurity Awareness and Third-Party Risk

• Establish appropriate cybersecurity awareness and training requirements for employees, management, privileged users and other relevant stakeholders based on their responsibilities and risk exposure.
• Monitor the effectiveness of cybersecurity awareness and behavioural-risk initiatives using performance measures, trends, security events and simulation outcomes.
• Ensure material third-party cybersecurity exposures and unacceptable control gaps are escalated to accountable risk owners and appropriate management forums.

7. Group Governance and Subsidiary Oversight

• Establish appropriate Group-level cybersecurity governance, risk, compliance and reporting expectations for subsidiaries.
• Take account of applicable local regulatory requirements when implementing cybersecurity governance across subsidiaries and other legal entities.

8. Budget and Resource Management

• Support the Head of Cybersecurity in developing and prioritising the cybersecurity budget.
• Ensure cybersecurity investments are aligned with material risks, regulatory requirements, strategic priorities and capability needs.
• Monitor strategic investment and budget performance and escalate significant constraints affecting delivery.

9. Team Leadership and Stakeholder Engagement

• Lead, coach and develop the Cybersecurity Governance, Risk & Compliance team.
• Establish clear accountability, performance expectations, professional development priorities and succession arrangements.
• Represent Cybersecurity GRC in relevant management, risk, audit, regulatory and governance forums.
• Provide constructive challenge on material cybersecurity risks and control matters.

Qualifications and Experience

Academic Qualifications

A Bachelor’s degree in any of the following fields:

• Cybersecurity
• Information Security
• Information Technology
• Computer Science
• Information Systems
• Risk Management
• Audit
• Computer or Telecommunications Engineering
• Business Information Systems
• Another relevant field.

Professional Experience

• Minimum of seven (7) years’ relevant experience in Cybersecurity Governance, Information Security Risk Management, Cybersecurity Compliance, Security Assurance, Technology Risk, IT Audit, Information Security Management or related cybersecurity disciplines.
• At least three (3) years’ experience in a managerial, supervisory or senior leadership role within cybersecurity governance, risk, compliance, audit or assurance.
• Demonstrated experience developing or overseeing cybersecurity governance and risk-management frameworks in a complex organisation.
• Experience coordinating cybersecurity internal audits, external assessments, regulatory reviews and remediation programmes. Banking or financial services experience is strongly preferred.
• Demonstrated experience managing material cybersecurity risks, control deficiencies, audit issues and regulatory compliance obligations.
• Experience with recognised cybersecurity standards and compliance frameworks, including ISO/IEC 27001, NIST CSF and PCI DSS.
• Experience developing cybersecurity strategies, management reports, KPIs, KRIs or cybersecurity maturity programmes.
• Experience advising senior management on cybersecurity risks, regulatory matters, control effectiveness and strategic priorities.
• Experience managing or overseeing third-party cybersecurity risks and security-governance requirements.
• Experience supporting cybersecurity governance across subsidiaries, multiple legal entities or regional operations will be an added advantage.

Professional Certifications

Relevant professional certifications include:

• Certified Information Systems Security Professional (CISSP)
• Certified Information Systems Auditor (CISA)
• Certified in Risk and Information Systems Control (CRISC)
• Certified in the Governance of Enterprise IT (CGEIT)
• Certified Chief Information Security Officer (CCISO)
• ISO 27001 Lead Implementer (LI) or Lead Auditor (LA)
• COBIT Foundations
• PCI DSS certifications.

About CRDB Bank PLC

CRDB Bank PLC is a leading banking institution in Tanzania in terms of assets, loans and advances, and customer deposits. The Bank has an ambition to expand its footprint across the wider East African region.

Equal Opportunity and Important Information

CRDB Bank is committed to sustainability and Environmental, Social and Governance (ESG) practices. Applicants who share this commitment are encouraged to apply.

The Bank promotes an inclusive workplace and encourages applications from women and persons with disabilities.

Important: CRDB Bank does not charge any fees for the application or recruitment process. Applicants should disregard any requests for payment, as these do not represent the Bank’s recruitment practices.

Only shortlisted candidates will be contacted.

How to Apply

Interested and qualified candidates should submit their applications online through the official CRDB Bank careers portal.

Application Deadline: 24 November 2026

CLICK HERE TO APPLY