Overview

Job Overview

Prime Life Insurance Limited is a Rwandan life insurance company established in 2011 and licensed by the National Bank of Rwanda (BNR). The company provides long-term insurance services and manages sensitive customer, financial, and personal information.

The Cybersecurity and IT Auditor will independently assess the company's information technology controls, cybersecurity environment, regulatory compliance, and technology-related risks. The position reports administratively to the Chief Executive Officer and presents cybersecurity and IT audit reports to the Board of Directors on a quarterly basis.

The role combines IT auditing, cybersecurity risk assessment, regulatory compliance, incident response support, governance, and staff awareness. The successful candidate will help identify control weaknesses, recommend improvements, monitor remediation, and support the company's efforts to protect its systems and data.

Why This Opportunity Matters

Why This Opportunity Matters

This position offers an opportunity for an experienced IT audit or cybersecurity professional to work within Rwanda's regulated insurance sector.

The role provides exposure to cybersecurity governance, IT general controls, application controls, data protection, risk management, cloud and outsourcing arrangements, incident response, and regulatory compliance. It also involves reporting directly to senior management and contributing to quarterly cybersecurity and IT audit reporting to the Board of Directors.

Candidates interested in combining technical cybersecurity knowledge with audit, risk, governance, and regulatory responsibilities may find this role particularly relevant.

Application Tips

Application Tips

Applicants should tailor their CV to demonstrate practical experience in both cybersecurity and IT auditing.

Important areas to highlight include:

IT audit and risk-based audit planning

IT general controls and application controls

Cybersecurity risk assessment

Network and endpoint security

Vulnerability assessment and penetration testing

Data protection and privacy compliance

Incident response and root-cause analysis

IT governance and control frameworks

ISO 27001, NIST, COBIT, or related frameworks

Cloud and IT infrastructure security

Regulatory compliance within Rwanda

Applicants with experience in insurance, banking, financial services, or another regulated environment should clearly state it.

Relevant professional certifications such as CISA, CISSP, CISM, CEH, or ISO/IEC 27001 Lead Auditor should be clearly listed.

The application should also demonstrate the candidate's ability to produce evidence-based audit reports, communicate risks to senior management, and follow remediation actions through to completion.

Responsibilities

Responsibilities

Cybersecurity and IT Audit

Plan and conduct risk-based audits covering network security, access management, data protection, application controls, cloud services, and outsourced technology arrangements.

Assess the design and operating effectiveness of IT general controls and IT application controls across insurance and financial systems.

Conduct periodic vulnerability assessments and coordinate independent penetration testing.

Track identified security weaknesses and audit findings until remediation is completed.

Assess compliance with Rwanda's data protection and privacy requirements, National Cyber Security Authority guidance, and applicable BNR cybersecurity and IT risk requirements.

Prepare evidence-based audit reports that identify risks, control weaknesses, and prioritized recommendations.

Present consolidated cybersecurity and IT audit reports to the Board of Directors on a quarterly basis.

Risk Assessment and Advisory

Maintain and regularly update the IT and cybersecurity risk register in line with the company's enterprise risk management framework.

Advise management on emerging cyber threats, control weaknesses, and relevant industry practices while maintaining audit independence.

Review new IT projects, system implementations, and vendor or outsourcing agreements to ensure cybersecurity and compliance requirements are considered from the design stage.

Incident Response and Reporting

Support cybersecurity incident response activities.

Assist with root-cause analysis and post-incident audit reviews.

Support preparation of statutory and regulatory notifications relating to data breaches in coordination with the Data Protection Officer, NCSA, and BNR.

Report audit findings and control gaps to the CEO and escalate significant matters through the established Board reporting process.

Governance, Policy and Awareness

Review IT security policies and standards covering areas such as access control, encryption, backup, and incident management.

Recommend improvements to cybersecurity policies and controls.

Support the development and delivery of cybersecurity awareness and staff training programmes.

Monitor the implementation of audit recommendations and regulatory findings until closure.

Regulatory Responsibilities

Support the Data Protection Officer function in maintaining compliance with applicable privacy requirements.

Monitor changes in Rwanda's cybersecurity, data protection, and financial-sector regulations.

Assess how regulatory changes may affect the company's IT and cybersecurity control environment.

Requirements

Requirements

Bachelor's degree in Information Technology, Computer Science, Information Systems Security, or a related field.

At least 3 years of professional experience in IT audit, cybersecurity, or information security risk management.

Experience within financial services or insurance IT environments is an advantage.

Familiarity with Rwanda's regulatory environment, including NCSA and BNR requirements, is required.

Technical knowledge of:

Firewalls, IDS/IPS, endpoint security, penetration testing, and VPNs.

IT general controls and application controls.

ITGC testing and recognized control frameworks such as COBIT, ISO 27001, and NIST.

Windows and Linux server environments.

Virtualization, cloud technologies, and network fundamentals including TCP/IP, VLANs, and firewalls.

Data protection principles, breach management, and regulatory reporting.

Preferred professional certifications include CISA, CISSP, CISM, CEH, and ISO/IEC 27001 Lead Auditor.

Experience with ISO 27001, NCSA requirements, BNR requirements, or other relevant compliance frameworks is an advantage.

The successful candidate should also demonstrate strong analytical, reporting, communication, risk assessment, and problem-solving skills.

How to Apply

How to Apply

Qualified and interested candidates should submit their application to Prime Life Insurance Limited by email.

Send the application to:

hr.it@prime.rw

The application must be submitted as one single PDF file and should contain:

Application letter addressed to the Chief Executive Officer.

Curriculum Vitae showing proven professional experience.

Copies of academic documents and professional certifications.

Copy of National Identification.

The application deadline is 23 August 2026 at 23:59 CAT.

Only shortlisted candidates will be contacted.