Manager, Business Continuity Planning & Compliance

KCB Bank Kenya is a leading financial institution founded in 1877, offering banking and financial services.

The purpose of this role is to lead the Group’s Technology Business Continuity Management (BCM) Resilience programs aligning with ISO 22301 and Central Bank regulatory mandates across multiple regional jurisdictions. The role holder is accountable for mandating and enforcing IT Disaster Recovery (DR) Resilience strategies that leverage emerging technologies—including Automated DR Failover Orchestration, Cloud-native resilience and Air-gapped backups to ensure the continuous availability of mission-critical banking systems across traditional, multi cloud, and microservices environments.

1. Technology Resilience & Recovery.
2. Mandate the Group-wide Technology BCM and Operational Resilience strategy, ensuring alignment with ISO 22301, global best practices, evolving regional regulatory mandates (e.g., CBK Prudential Guidelines) while integrating modern Cloud-Native resilience patterns, Automated DR Failover Orchestration, and Infrastructure as Code (IaC) for automated recovery.
3. Partner with Group Cybersecurity to design and test specialized “Cyber Recovery Playbooks” (e.g., Ransomware recovery, immutable backups) to defend against and rapidly recover from destructive cyber-attacks.
4. DR Failover Simulations Orchestration & Testing.
5. Direct and orchestrate multi-jurisdictional Disaster Recovery (DR) and Cyber Resilience failover simulations for the Group’s Core Banking and Tier-1 applications, rigorously validating strict Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO).
6. Develop technology-related crisis management frameworks and facilitate IT DRP simulation exercises (Tabletop drills) for the Group Technology teams.
7. High-Availability (HA) & BIA.
8. Challenge Enterprise Architects and system owners on High Availability and redundancy designs; exercise authority to mandate the elimination of Single Points of Failure (SPOFs) across physical data centers and decentralized Multi-Cloud/Containerized architectures.
9. Lead Business Impact Analyses (BIA) and IT Threat/Vulnerability assessments to proactively align technology recovery strategies with business demands.
10. Third-Party Cloud Resilience & Supply Chain Governance.
11. Execute resilience audits and risk assessments of critical third-party technology vendors, SaaS/PaaS Cloud Service Providers (CSPs), and FinTech partners to prevent supply chain disruptions and mitigate systemic concentration risks.
12. Executive Reporting & Remediation Enforcement
13. Design high-impact Operational Resilience dashboards and present strategic BCM risk profiles and compliance postures to the Group Risk Management Committee and the Board.
14. Mandate and strictly track the closure of critical vulnerabilities, architectural gaps, and lessons learned identified during DR simulation exercises to their logical conclusion.

1. A bachelor’s degree in Computer Science, Information Systems, Information Security or a related IT field is required.
2. Professional Qualifications in Business Continuity / Resilience (CBCP (Certified Business Continuity Professional), AMBCI, MBCI, or ISO 22301 Lead Implementer / Auditor) is required.
3. Professional Qualifications in Technology Governance & Security (CISA, CISM, CISSP, CRISC, or ITIL v4) is advantage.
4. Master’s degree in business or technology is added advantage.
5. At least 5 years’ experience in IT operations, architecture, or assurance functions within the Financial Services industry is required.
6. At least 4 years of deep, practical knowledge of current business continuity planning techniques, disaster recovery, and performing complex risk and business impact analyses (BIA) is required.
7. At least 3 years of demonstrated exposure to IT resilience practices, including Cloud-native recovery orchestration, Infrastructure as Code (IaC), Automated DR Failover Orchestration, and governing SaaS/PaaS resilience.
8. At least 3 years in strong understanding of Core IT applications and experience in governing Third-Party/Vendor technology resilience.
9. At least 4 years of proven track record of managing cross-functional technical teams during high-pressure crisis events or large-scale DR simulations.
10. At least 3 years of practical knowledge of prudential guidelines on BCM and ICT Risk Management (e.g., CBK regulations).