Reporting to the Senior Manager, Cyber Secure by Design , the Senior Officer - Cyber Secure by Design will support Safaricom's security assurance program by embedding security into all products, platforms, and services before go-live. The role will also provide timely security assurance reports and advice to the business when required, and within very tight timelines. The Senior Officer will also support other Cyber Secure by Design practices, including Red Teaming, bug bounty, and DevSecOps.
Responsibilities
Security Assurance for Projects
Conduct periodic security reviews, vulnerability assessments & penetration tests across all of Safaricom's systems/infrastructure
Ensure all new and existing systems/products/services comply with Company's security policies & standards and other industry best practices e.g. ISO27001, CIS and Kenya Data Protection Act
Provide timely and quality security assurance reports and advice to the business when required even with very tight deadlines
Do regular follow ups with system custodians/owners to ensure any security risks identified are addressed within the agreed timelines
Define Cyber Security metrics and report periodically on security compliance across all networks/systems
Bug Bounty Program Management
Drive the remediation of the identified/reported bug bounty findings and integrate the learnings to different areas of application.
Red Teaming & Offensive Security
Carry out red team exercises, providing input to scope, reviewing findings, and tracking remediation progress. Deliver insights on risks, while fostering purple team collaboration and continuous upskilling in offensive security.
DevSecOps Strategy & Tooling Governance
Ensure CI/CD pipelines integrate required security tools and practices. Carry out developer security training to embed secure coding practices.
Knowledge share
Conduct knowledge share sessions on new areas of technology, bug bounty learning, read teaming findings within the squads and larger organization.
Research & Development
Conduct research and development on emerging areas in security.
Present findings for sensitization and knowledge transfer to other team members and staff.
Health & Safety
Uphold the company code of conduct, policies and procedures, ensuring integrity and accountability in every aspect of your work
All employees have a responsibility to adhere to safety, health, and wellbeing policies.
Qualifications
Degree in Information Security/Computer Forensics/Computer Science/Information Technology or other relevant Technical Degree
Information security certifications e.g. CEH/CISSP/CISM/CISA/GIAC/CPTP/OSCP
Networking certifications: CCNA/CCNP/CCSP are also preferred
Certifications in Microsoft Windows and Linux/Unix Operating Systems
Demonstrate competency in the use and administration of ethical hacking tools e.g. KALI Linux, Metasploit, Nexpose, Nessus, Nmap, Burp Suite etc.
Minimum of 3 years' working experience in Information Systems Security - e.g. Ethical Hacking,
Penetration Testing, Vulnerability Assessments, ICT Audits, Pre-and-Post Implementation System Reviews etc.
Minimum of 3 years' working experience in Networking and Operating Systems e.g. Cisco, Huawei, Windows (All), Unix, Linux etc.
Minimum of 3 years' working experience in Web and Mobile applications technologies e.g. Java, Python, PHP, Javascript, CSS, Apache, Nginx, IIS etc.
Working knowledge of databases e.g. Oracle, MSSQL, MongoDB, Postgres etc. will be an added advantage
Working knowledge of Virtualization & Microservices technologies e.g. VMware, Open shift, Kubernetes, Docker etc. will be an added advantage
Working knowledge and experience in DevSecOps technologies and practices i.e. Jenkins, Jira, GitHub, Gitlab etc. will be an added advantage
Working knowledge of Mobile and GSM technologies e.g. Android, IOS, 2G, 3G, LTE, USSD etc. will be an added advantage
Experience operating within squads/tribes, driving security automation adoption across engineering, operations, cloud, and digital product teams.
Excellent communication skills and a good team player
Excellent time management skills i.e. getting things done in a timely manner