BACKGROUND

Prime Life Insurance Limited was established in December 2011 in compliance with regulatory directives requiring the separation of short-term and long-term insurance policies. In May 2012, the company obtained its license from the National Bank of Rwanda to deliver life insurance services.

Fully accredited by the National Bank of Rwanda, Prime Life Insurance Limited offers a comprehensive range of long-term insurance solutions across Rwanda.

As a licensed financial institution entrusted with sensitive customer, financial, and health data, Prime Life Insurance is committed to a strong cybersecurity and IT control environment aligned with the National Cyber Security Authority (NCSA), Law N° 058/2021 on the Protection of Personal Data and Privacy, and applicable National Bank of Rwanda (BNR) requirements. In line with this commitment, Prime Life Insurance is seeking a highly skilled, self-motivated, and experienced professional to join its team as a Cybersecurity and IT Auditor.

POSITION: CYBERSECURITY AND IT AUDITOR (1)

Reporting administratively to the Chief Executive Officer (CEO) and presenting cybersecurity and IT audit reports to the Board of Directors on a quarterly basis, the Cybersecurity and IT Auditor will be tasked with independently assessing and reporting on IT and cybersecurity controls, regulatory compliance, risk advisory, incident response assist, and governance, as outlined in the responsibilities below.

RESPONSIBILITIES:

A. Cybersecurity & IT Audit (35%)

Plan and execute risk-based audits covering network security, access management, data protection, application controls, and cloud/outsourcing arrangements.

Assess the design and operating effectiveness of IT general controls (ITGCs) and IT application controls across core insurance and finance systems.

Conduct periodic vulnerability assessments and organize independent penetration testing, and track remediation to closure.

Evaluate compliance with Law N° 058/2021 on data protection and privacy, NCSA guidelines, and BNR cybersecurity and IT risk requirements.

Prepare evidence-based audit reports with risk ratings and prioritised recommendations for the CEO, and present consolidated cybersecurity and IT audit reports to the Board of Directors on a quarterly basis.

B. Risk Assessment & Advisory (20%)

Keep and update the IT and cyber risk register in line with the enterprise risk management framework.

Advise management on emerging cyber threats, control weaknesses, and industry good practice, without compromising audit independence.

Evaluate new IT projects, system implementations, and vendor/outsourcing agreements to ensure security and compliance requirements are embedded from design stage.

C. Incident Response & Reporting (20%)

Support the cybersecurity incident response process, including root-cause analysis and post-incident audit evaluate.

Help with preparing statutory and regulatory notifications for data breaches, in coordination with the Data Protection Officer, NCSA, and BNR.

Report audit outcomes and control gaps to the CEO, escalating significant matters to the Board of Directors at the quarterly reporting cycle.

D. Governance, Policy & Awareness (15%)

Evaluate and recommend updates to IT security policies and standards (access control, encryption, backup, incident management).

Assist the design and delivery of staff cybersecurity awareness and training programmes.

Track remediation of audit findings and regulatory recommendations to closure.

E. Regulatory Responsibilities (10%)

Support the Data Protection Officer (DPO) function in ensuring compliance with data privacy regulations.

Track changes in Rwanda's cybersecurity, data protection, and financial-sector regulations and assess their impact on the Company's control environment.

Education & Experience Requirements

a) Qualifications:

Bachelor's degree in Information Technology, Computer Science, Information Systems Security, or a related field.

Minimum 3+ years of experience in IT audit, cybersecurity, or information security risk management.

Experience in financial services or insurance sector IT environments is a plus.

Familiarity with Rwanda's regulatory environment (NCSA, BNR) is required;

b) Technical Skills & Competencies:

Cybersecurity: Firewalls, IDS/IPS, endpoint security, penetration testing, VPNs.

IT Audit: IT general and application controls, ITGC testing, control frameworks (COBIT, ISO 27001, NIST).

IT Infrastructure: Windows/Linux server environments, virtualization, cloud, and network fundamentals (TCP/IP, VLANs, firewalls).

Data Protection: Data privacy principles, breach management, and regulatory reporting requirements.

Preferred Certifications: CISA, CISSP, CISM, CEH, ISO/IEC 27001 guide Auditor is a plus.

Experience in compliance and regulatory frameworks (e.g. ISO 27001, NCSA/BNR requirements) is a plus.

• Plan and execute risk-based audits covering network security, access management, data protection, application controls, and cloud/outsourcing arrangements.
• Assess the design and operating effectiveness of IT general controls (ITGCs) and IT application controls across core insurance and finance systems.
• Conduct periodic vulnerability assessments and organize independent penetration testing, and track remediation to closure.
• Evaluate compliance with Law N° 058/2021 on data protection and privacy, NCSA guidelines, and BNR cybersecurity and IT risk requirements.
• Prepare evidence-based audit reports with risk ratings and prioritised recommendations for the CEO, and present consolidated cybersecurity and IT audit reports to the Board of Directors on a quarterly basis.
• Keep and update the IT and cyber risk register in line with the enterprise risk management framework.
• Advise management on emerging cyber threats, control weaknesses, and industry good practice, without compromising audit independence.
• Evaluate new IT projects, system implementations, and vendor/outsourcing agreements to ensure security and compliance requirements are embedded from design stage.
• Support the cybersecurity incident response process, including root-cause analysis and post-incident audit evaluate.
• Help with preparing statutory and regulatory notifications for data breaches, in coordination with the Data Protection Officer, NCSA, and BNR.
• Report audit outcomes and control gaps to the CEO, escalating significant matters to the Board of Directors at the quarterly reporting cycle.
• Evaluate and recommend updates to IT security policies and standards (access control, encryption, backup, incident management).
• Assist the design and delivery of staff cybersecurity awareness and training programmes.
• Track remediation of audit findings and regulatory recommendations to closure.
• Support the Data Protection Officer (DPO) function in ensuring compliance with data privacy regulations.
• Track changes in Rwanda's cybersecurity, data protection, and financial-sector regulations and assess their impact on the Company's control environment.

• Cybersecurity: Firewalls, IDS/IPS, endpoint security, penetration testing, VPNs.
• IT Audit: IT general and application controls, ITGC testing, control frameworks (COBIT, ISO 27001, NIST).
• IT Infrastructure: Windows/Linux server environments, virtualization, cloud, and network fundamentals (TCP/IP, VLANs, firewalls).
• Data Protection: Data privacy principles, breach management, and regulatory reporting requirements.
• Experience in compliance and regulatory frameworks (e.g. ISO 27001, NCSA/BNR requirements) is a plus.

• Bachelor's degree in Information Technology, Computer Science, Information Systems Security, or a related field.
• Minimum 3+ years of experience in IT audit, cybersecurity, or information security risk management.
• Experience in financial services or insurance sector IT environments is a plus.
• Familiarity with Rwanda's regulatory environment (NCSA, BNR) is required.
• Preferred Certifications: CISA, CISSP, CISM, CEH, ISO/IEC 27001 guide Auditor is a plus.