Cyber Security Administrator (Operations)

Role Overview

As a Cyber Security Administrator at Kenya Airways, you sit at the intersection of offence and defence: probing our systems the way a real attacker would, then using what you learn to harden the controls that protect our network, endpoints, applications, and data. Day to day you will run penetration tests, red team simulations, and vulnerability assessments while also operating the detection, response, and automation tooling that keeps our security operations centre effective. This role matters because every weakness you find and close before an adversary does directly reduces the risk of disruption to airline operations, customer data, and critical business systems.

Key Responsibilities

• Offensive testing and adversary emulation: Plan and execute penetration tests, red team exercises, adversary emulation campaigns, and vulnerability assessments, mapping findings to the MITRE ATT&CK framework to stress-test whether our defensive controls actually hold up.
• Detection engineering and monitoring: Deploy, tune, and maintain SIEM, EDR/XDR, and encryption solutions so that malicious activity is surfaced quickly, false positives stay manageable, and coverage gaps are closed.
• Incident response leadership: Triage, investigate, contain, eradicate, and recover from security incidents; drive root cause analysis, coordinate with internal teams and external partners, and implement corrective actions that stop the same incident recurring.
• Playbook and response readiness: Maintain and continuously improve incident response plans and playbooks for common attack scenarios, keeping them aligned with how threats actually behave.
• Threat intelligence and automation: Operationalise threat intelligence feeds and adversary TTPs into updated detection rules and blocked IOCs, and build SOAR workflows that automate alert triage, enrichment, and routine response tasks.
• Risk assessment and control validation: Continuously identify, assess, and monitor information security risks across internal and external environments, escalate emerging threats, and validate control effectiveness through scanning, monitoring, and testing.
• Cross-functional collaboration: Work alongside developers, systems and database engineers, security engineers, project managers, and SOC analysts, and run purple team exercises that translate offensive findings into concrete defensive improvements.
• Audit, assurance, and project security: Partner with internal audit and external consultants on security assessments, ensure projects and systems pass security checks before and after go-live, and enforce hardening baselines and configuration standards across the estate.

Requirements & Qualifications

• Bachelor's degree in information technology or a closely related discipline.
• At least 3 years of advanced IT experience with a strong information security focus, including hands-on defensive security operations work.
• Demonstrated practical experience in penetration testing, ethical hacking, and vulnerability assessments, alongside security monitoring, incident detection and response, and vulnerability management.
• Proficiency with SIEM platforms and hands-on use of vulnerability scanning and management tools.
• Ability to configure systems to detect intrusions and tailor them to the organisation's specific monitoring needs.
• Strong working knowledge of networking protocols and common attack vectors, plus familiarity with security auditing processes and information security audits or risk assessments.
• Comfortable with Linux commands and scripting, and with the adoption of Windows security controls.
• Knowledge of how to secure network technologies, applications, and operating systems.
• Experience responding to, analysing, and communicating information security incidents, including forensic investigation and formal report writing.
• Working understanding of common security standards and regulations such as PCI DSS, NIST, ISO 27001, GDPR, and IOSA, with the ability to enforce security best practice in line with the National Institute of Standards and Technology.
• Industry certifications are strongly preferred: CEH, CDSA, CISSP, SSCP, or equivalent offensive and defensive security credentials.
• An attacker's mindset combined with strong analytical and critical-thinking skills, and the resilience to stay calm and effective under pressure on high-priority problems.
• Excellent interpersonal, communication, and presentation skills, with the credibility to brief technical and non-technical audiences alike.
• Unquestionable integrity, strong ethical standards, a commitment to responsible disclosure, and a self-motivated drive to keep learning as the threat landscape evolves.