Senior Officer, Cyber Secure by Design

• Support Safaricom's security assurance program by embedding security into products, platforms, and services before launch.
• Conduct security reviews, vulnerability assessments, and penetration tests across company systems and infrastructure.
• Ensure compliance with security policies, standards, and industry best practices including ISO27001, CIS, and Kenya Data Protection Act.
• Provide timely security assurance reports and advice to business units, even under tight deadlines.
• Follow up with system owners to ensure identified security risks are addressed promptly.
• Manage the bug bounty program by driving remediation of findings and integrating lessons learned.
• Conduct red team exercises, review findings, and track remediation progress while promoting collaboration and upskilling.
• Ensure security tools and practices are integrated into CI/CD pipelines and provide developer security training.
• Conduct knowledge sharing sessions on technology, bug bounty insights, and red teaming findings.
• Research emerging security areas and present findings for team knowledge transfer.
• Uphold company policies, code of conduct, and health and safety standards.

• Degree in Information Security, Computer Forensics, Computer Science, Information Technology, or related technical field.
• Information security certifications such as CEH, CISSP, CISM, CISA, GIAC, CPTP, or OSCP.
• Preferred networking certifications include CCNA, CCNP, and CCSP.
• Certifications in Microsoft Windows and Linux/Unix operating systems.
• Competency in ethical hacking tools like KALI Linux, Metasploit, Nexpose, Nessus, Nmap, and Burp Suite.
• At least 3 years of experience in Information Systems Security including ethical hacking, penetration testing, vulnerability assessments, ICT audits, and system reviews.
• At least 3 years of experience in networking and operating systems such as Cisco, Huawei, Windows, Unix, and Linux.
• At least 3 years of experience with web and mobile application technologies including Java, Python, PHP, Javascript, CSS, Apache, Nginx, and IIS.
• Preferred knowledge of databases like Oracle, MSSQL, MongoDB, and Postgres.
• Preferred knowledge of virtualization and microservices technologies such as VMware, OpenShift, Kubernetes, and Docker.
• Preferred experience with DevSecOps tools and practices including Jenkins, Jira, GitHub, and GitLab.
• Preferred knowledge of mobile and GSM technologies like Android, iOS, 2G, 3G, LTE, and USSD.
• Experience working within squads or tribes and driving security automation across engineering, operations, cloud, and digital product teams.
• Strong communication, teamwork, time management, report writing, presentation, analytical skills, attention to detail, and customer focus.

To apply, create or update your candidate profile on the employer's recruitment portal. Complete all sections including work experience and certifications, then submit your application by attaching your resume. The closing date for applications is Sunday, 18 October 2026.