- Location
- Nairobi, Nairobi
- Type
- Full-time
- Department
- Security
- Seniority
- Lead
- Experience
- 7+ years
- Education
- Master
- Closing date
- Today
- Source
- ApplyToJob
Description
About the Role
The Information Security Lead will own BURN’s information security programme across cloud and on-premise infrastructure, business applications, and the factory and field networks that support our IoT-enabled products. They will lead remediation of known security gaps, establish identity, data protection, and third-party access controls, and build the policies, monitoring, and incident response capability BURN needs to grow securely across its markets. Reporting to the Director of Information Systems, they will coach a small security function and work closely with IT, NOC, and Engineering.
Duties and Responsibilities:
Requirements (E – essential, D – desirable):
The Information Security Lead will own BURN’s information security programme across cloud and on-premise infrastructure, business applications, and the factory and field networks that support our IoT-enabled products. They will lead remediation of known security gaps, establish identity, data protection, and third-party access controls, and build the policies, monitoring, and incident response capability BURN needs to grow securely across its markets. Reporting to the Director of Information Systems, they will coach a small security function and work closely with IT, NOC, and Engineering.
Duties and Responsibilities:
- Lead remediation of findings from external security assessments across network, web, mobile, and cloud environments, tracking closure against risk-based timelines.
- Define and deliver the information security roadmap, policies, and standards, including data classification, data loss prevention (DLP), access control, and BYOD.
- Own identity and access management, including the Microsoft Entra ID rollout, MFA, privileged access, and periodic role-based access reviews across ERP and internal business systems.
- Secure AWS and on-premise infrastructure, including IAM, network segmentation, logging, CI/CD pipelines, and infrastructure-as-code.
- Establish security monitoring, incident response, and breach management, acting as technical lead during security incidents and running an annual breach simulation.
- Partner with Legal and Compliance to meet the Kenya Data Protection Act and data protection requirements in other markets, including data retention and data subject rights.
- Govern vendor and third-party access, including security due diligence and data processing agreements for suppliers and platform partners.
- Plan and coordinate vulnerability assessments and penetration testing, and verify that fixes are effective.
- Support disaster recovery and backup testing with IT, run security awareness for staff, and coach team members developing cybersecurity skills.
Requirements (E – essential, D – desirable):
- Bachelor’s degree in computer science, engineering, or a related field. (D)
- 7+ years of experience in information or infrastructure security, including at least 2 years leading security initiatives or teams. (E)
- Strong hands-on experience securing cloud environments, particularly AWS, including IAM, networking, and logging. (E)
- Experience with identity and access management, including Microsoft Entra ID and Microsoft 365 security, MFA, and privileged access. (E)
- Proven experience running vulnerability management and penetration testing programmes, and driving remediation with engineering and IT teams. (E)
- Experience leading security incident response and building security monitoring and logging capability (SIEM or equivalent). (E)
- Working knowledge of security frameworks (e.g., ISO 27001, NIST CSF, CIS Controls) and data protection regulation, including the Kenya Data Protection Act 2019, with experience writing policies and standards. (E)
- Experience with infrastructure-as-code and securing CI/CD pipelines (e.g., Terraform, Ansible). (D)
- Experience securing manufacturing, OT, or IoT environments. (D)
- Ability to explain security risk clearly to technical and non-technical audiences, including senior leadership. (E)
- Strong stakeholder management, problem-solving, and collaboration skills. (E)
- Recognised security certification (e.g., CISSP, CISM, CCSP, OSCP, AWS Certified Security – Specialty). (D)
Qualified Female Candidates encouraged to apply
BURN does not charge a fee at any stage of the recruitment process (application, interview, meeting, processing, training, or any other fees).
BURN does not charge a fee at any stage of the recruitment process (application, interview, meeting, processing, training, or any other fees).
Skills
AWSTerraformAnsibleCI/CDCybersecurityPenetration TestingSIEMComplianceLoss PreventionERPISO 27001AWS CertifiedCISSP