PURPOSE:

Reporting to the Director Risk & Compliance, the Risk Manager will be responsible for identifying, analyzing, assessing and designing control/mitigation activities for the risks within the company and to ensure compliance to the set controls.

PRIMARY RESPONSIBILITIES:

Risk Management

• Develop, implement, and continuously improve the company’s Enterprise Risk Management framework aligned with ISO 31000 and COSO ERM standards.
• Conduct comprehensive risk assessments across operational, strategic, financial, compliance, cyber, ESG, and reputational areas.
• Facilitate annual risk appetite and tolerance reviews with the Board and Executive Committee.
• Establish and maintain a centralized risk register and ensure regular updates by all departments.
• Develop, test, and monitor business continuity and disaster recovery plans.
• Provide actionable risk insights to support strategic decision-making.
• Assessment of risk positions and exposures for all CIC Group entities as well as actions taken to manage these risks.
• Analysis of trends and patterns and developing rules and strategies to improve the efficiency of risk identification and assessment.
• Preparation and/or regular update of the risk framework, risk registers, risk appetite statements and risk tolerance statements for each of the CIC Group entities.
• Assessment of changes in CIC Group’s risk profile and pre-defined risk limits and advising management accordingly.
• Analyze emerging risks and trends, and develop strategies to mitigate exposure.
• Oversee development and implementation of risk mitigation plans and action tracking mechanisms.
• Ensure timely reporting to senior management and the Board, including updates on risk appetite, tolerance levels, and residual risk.

Business Continuity

• Review and maintain the Business Continuity Management (BCM) Framework and ensure alignment to ISO 22301: 2019 and other laws, regulations and standards in relation to business continuity management.
• Manage the implementation and coordination of the Group’s Business Continuity Management (BCM) Framework and support the Management on Business Continuity Management (BCM) policies and practices, to identify, evaluate, and address the entire portfolio of strategic & operational risks and vulnerabilities that presents risks to the continuity of business in the event of various impacts.
• Coordinate the Annual Business Impact Analysis for all units across the Group and ensure documented Business Continuity Plans (BCPs) are in place and updated in line with the Company’s Business Continuity Management (BCM) policy and International best practice.
• Plan, coordinate, and document regular testing of Business Continuity Plans (BCPs) to validate their effectiveness, identify gaps, and ensure organizational readiness during potential disruptions.

Reporting & Communication

• Prepare high-quality reports and presentations for executive and board-level risk and compliance discussions.
• Provide quarterly status reports on data protection and risk management to senior and middle management.
• Escalate instances of non-compliance or high-impact risk events promptly, with recommended actions.

Leadership & People Management

• Supervise and coach the reportees, including performance appraisals and development planning.
• Foster cross-functional collaboration on risk and compliance initiatives across CIC subsidiaries.

Key Skills, Knowledge, Experience and Behavioural Competencies

Professional Qualification

Required Certifications:

• CISA (Certified Information Systems Auditor)
• CISM (Certified Information Security Manager)
• CRM (Certified Risk Manager)
• or Progress towards CPA (Certified Public Accountant)

Added Advantage:

• IRMCert (Institute of Risk Management Certificate)
• Knowledge of ISO 31000 (Risk Management Guidelines)

Experience Required

Relevant Experience

• Description: Relevant experience in the field
• Required Years of Experience: Minimum of 8 years

Education

• Qualification: Bachelor’s Degree
• Specific Field or Qualification: Bachelor’s degree from a recognized university.

The application should reach us by close of business on 3^rd October, 2025. Please note only short-listed candidates will be contacted. If you do not hear from us by 30^th November, 2025 consider your application unsuccessful.

N/B: This job advert is open to both internal and external candidates.