Reporting to the Technology Risk and Cybersecurity Manager, the Cyber Risk Specialist is responsible for the identification, assessment, monitoring, and reporting of cybersecurity risks across CIC Insurance Group’s technology estate. The role supports the Technology Risk and Cybersecurity Manager in executing the ICT and cybersecurity risk programme. The role holder brings specialist cyber risk expertise that complements the broader ICT risk function focusing specifically on cybersecurity threat assessment, vulnerability management, security monitoring, and third-party cyber risk and is expected to operate with a high degree of technical competence, independence, and initiative across CIC Group.
Key Responsibilities
Cyber Risk Assessments: Conduct assessments across the Group’s IT infrastructure, systems, applications, and data assets, documenting threats, vulnerabilities, likelihood, impact ratings, and recommended treatment actions in the Group’s cyber risk register.
Risk Register Maintenance: Maintain and update the cyber risk register, ensuring all identified risks are classified, prioritised, assigned to risk owners, and tracked through to treatment or acceptance in line with the Group’s risk appetite framework.
Collaboration: Work closely with the ICT Risk Specialist to ensure that cybersecurity risks within the broader IT risk landscape are consistently identified, cross-referenced, and reported avoiding duplication while maintaining complete coverage of the technology risk environment.
Project & Innovation Support: Support the Project and Innovation Risk Lead by providing specialist cyber risk input into project and innovation risk assessments, ensuring that cybersecurity threats and control requirements are identified and incorporated into project plans, Risk register, and change requests from initiation through to delivery.
Vulnerability Management: Lead vulnerability screening across the Group’s technology environment, develop curative strategies for identified vulnerabilities, and track remediation progress.
Security Monitoring: Conduct real-time security monitoring, investigate and respond to security alerts from firewalls, intrusion detection systems, anti-malware software, and other monitoring tools, and escalate material incidents in accordance with the Cyber Incident Response Plan.
Incident Response: Support the Technology Risk and Cybersecurity Manager in leading the response to cybersecurity incidents, including triage, containment, evidence documentation, and preparation of incident reports suitable for internal governance or IRA submission.
Third-Party Risk: Conduct cyber risk assessments for third-party vendors and technology partners, reviewing security questionnaires, certifications, penetration test reports, and incident history maintaining the third-party cyber risk register.
Technical Testing: Support annual penetration testing exercises and red / blue teaming activities, reviewing findings with technical teams and tracking remediation actions to closure.
Reporting: Prepare cyber risk reports, dashboards, and management information for the Technology Risk and Cybersecurity Manager, including quarterly emerging ICT risk research reports and risk presentations for governance committees.
Awareness Training: Support the delivery of cybersecurity awareness activities, contribute to staff training materials, and share threat intelligence and security alerts with relevant stakeholders across the Group.
General Responsibilities
Participate in departmental planning, budgeting, and various governance meetings and committees as required.
Stay current with developments in the cybersecurity field, share emerging threat intelligence with the Cybersecurity Manager and relevant teams, and recommend new security technologies where appropriate.
Support internal and external audit engagements on cybersecurity matters, providing evidence, analysis, and technical input as required.
Requirements
Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a related field.
Relevant professional certifications such as CISA, CISM, CISSP, CEH, or similar.
Additional cloud security certifications (AWS, Azure, GCP) are a plus.
Minimum of four (4) years of hands-on IT security experience.
Experience in financial services and insurance is preferred.
Proven experience in conducting penetration tests, vulnerability assessments, and leading closure of findings through collaborating with various stakeholders.
Strong knowledge of security frameworks and standards (e.g., ISO 27001, NIST).
Experience working across multiple African jurisdictions is an advantage.
Key Competencies
Strong technical knowledge of cybersecurity risk management principles.
Ability to conduct and document structured cyber risk assessments.
Strong analytical, report-writing, and presentation skills.
High personal integrity, discretion, and reliability in handling sensitive security information.
Intellectual authority and technical confidence.
Stakeholder management and communication skills.
Deep awareness of both internal and external threat environments, including sector-specific attack patterns.
