Information Security Lead

• Lead the remediation of security issues found in external assessments across network, web, mobile, and cloud environments, ensuring timely closure.
• Develop and implement the information security roadmap, policies, and standards including data classification, data loss prevention, and access control.
• Manage identity and access systems, including Microsoft Entra ID rollout, multi-factor authentication, privileged access, and role-based access reviews.
• Secure AWS and on-premise infrastructure focusing on identity and access management, network segmentation, logging, and CI/CD pipelines.
• Set up security monitoring, incident response, and breach management, leading technical responses to security incidents and conducting annual breach simulations.
• Collaborate with Legal and Compliance teams to comply with the Kenya Data Protection Act and other data protection requirements.
• Oversee vendor and third-party access security, including due diligence and data processing agreements.
• Coordinate vulnerability assessments and penetration testing, ensuring effective remediation.
• Support disaster recovery and backup testing, conduct security awareness training, and mentor team members in cybersecurity skills.

• At least 7 years of experience in information or infrastructure security, with a minimum of 2 years in a leadership role.
• Strong practical experience securing cloud environments, especially AWS, including identity and access management, networking, and logging.
• Experience with Microsoft Entra ID, Microsoft 365 security, multi-factor authentication, and privileged access management.
• Proven ability to manage vulnerability and penetration testing programmes and lead remediation efforts.
• Experience leading security incident response and building security monitoring and logging capabilities such as SIEM.
• Knowledge of security frameworks like ISO 27001, NIST CSF, CIS Controls, and data protection laws including the Kenya Data Protection Act 2019.
• Ability to communicate security risks clearly to both technical and non-technical audiences, including senior leadership.
• Strong stakeholder management, problem-solving, and collaboration skills.
• A bachelor's degree in computer science, engineering, or related field is desirable.
• Experience with infrastructure-as-code tools like Terraform or Ansible is desirable.
• Experience securing manufacturing, operational technology, or IoT environments is desirable.
• Possession of recognised security certifications such as CISSP, CISM, CCSP, OSCP, or AWS Certified Security - Specialty is desirable.

Apply through the employer's official contact. The employer has not published a closing date.