Looking for a job

Steve B

@steveb

Technology risk governance executive at EQUITY GROUP, standardizing cybersecurity policies and rolling out automated GRC monitoring.

Kenya

Message

At EQUITY GROUP, I’m standardizing technology, information and cybersecurity risk policies, indicators and registers across operating subsidiaries. I’ve championed the rollout of ManageEngine GRC and designed executive risk dashboards for Board Audit Committees.

Previously at NCBA BANK GROUP, I led ISO 27001:2022 certification and co-designed continuous auditing that reduced manual control testing by 60%. At SAFARICOM PLC (VODACOM GROUP), I built the cyber and technology risk framework and led ISO 27001 re-certification for M-PESA and core telecom infrastructure.

Experience

Work history, roles, and key accomplishments

Head - Group Information Systems Audit, Cyber & Control Analytics

NCBA Bank Group

Jan 2018 - Jun 2026 (8 years 5 months)

Led the end-to-end implementation and successful certification of the Group ISMS under ISO 27001:2022 across core banking, APIs, and cloud environments. Overhauled data privacy and operational resilience frameworks for GDPR and DORA compliance, and co-designed automated control testing using KNIME and Power BI, reducing manual control testing by 60%.

ISO 27001 GDPR DORA KNIME Power BI Continuous Auditing T24 API Security Cloud Security

Principal Officer - Cyber & Technology Risk

Safaricom PLC

Jan 2015 - Jan 2018 (3 years)

Built the Cyber & Technology Risk framework from inception within the Risk Division, establishing risk measurement and mitigation baselines across high-volume transaction platforms. Successfully led the ISO 27001 re-certification project for M-PESA and core telecom infrastructure, and managed multi-million-dollar security budgets.

ISO 27001 QRadar SIEM ArcSight EDR Security Budget Management Vendor Management Risk Frameworks

Manager - IT Risk & Controls

Co-operative Bank of Kenya

Jan 2013 - Jan 2015 (2 years)

Directed the institution's initial ISO 27001 certification, standardizing IT risk policies and third-party risk management for over 150 branches and digital channels.

ISO 27001 IT Risk Third Party Risk Management Policy Standardization

Consultant - Information Risk & Assurance

Deloitte East Africa

Jan 2012 - Jan 2013 (1 year)

Executed risk-based technology security reviews, IT general controls (ITGC) audits, and regulatory readiness assessments for multi-national commercial clients.

IT General Controls Risk Assessment Regulatory Readiness Security Reviews