ICT Security Manager

Role Overview

The ICT Security Manager leads the day-to-day protection of Tower SACCO’s technology environment, covering networks, infrastructure, business applications, digital services, data and third-party connections. The role sets security controls, monitors and reduces risk, and coordinates the response to incidents so the SACCO can protect sensitive member information and maintain secure, dependable services.

Key Responsibilities

• Develop, maintain and improve cybersecurity policies, procedures, control standards and security governance across the organisation.
• Assess the security of networks, servers, endpoints, databases, identity systems, applications and digital channels; recommend and track corrective actions.
• Coordinate vulnerability assessments and authorised penetration tests, prioritise findings by risk, and verify that remediation is completed.
• Monitor security events, investigate suspected threats and lead incident response, including containment, recovery, documentation and follow-up improvements.
• Manage identity and access controls, including privileged access, authentication, authorisation and periodic access reviews.
• Advise technology and business teams on secure system configuration, application and API security, threat modelling and operating-system hardening.
• Evaluate technology risks and third-party security arrangements, and work with ICT, Risk, Internal Audit, business units and vendors on appropriate controls.
• Maintain security records, evidence, risk registers and remediation reports, and communicate technical issues and business impacts to management and other stakeholders.

Requirements & Qualifications

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, Information Systems or a related discipline.
• At least five years of relevant ICT experience, including a minimum of three years with demonstrable responsibility in cybersecurity, security operations, infrastructure security, technology risk or a related area.
• Recognised information or cybersecurity certification, such as CISM, CISSP, CISA, CEH, CCNA Cybersecurity or Cyber Ops, CCSP, or an equivalent qualification. A combination of governance-focused and hands-on technical certifications is an advantage.
• Practical experience securing enterprise networks, Windows or Linux servers, Active Directory, databases, virtualisation environments, endpoints, firewalls, VPNs and business applications.
• Hands-on experience with vulnerability assessment, penetration testing, incident handling, access-control reviews and remediation tracking.
• Knowledge of security frameworks and practices such as ISO/IEC 27001, the NIST Cybersecurity Framework, CIS Controls and OWASP principles is desirable.
• Experience in financial services, banking, payments, a SACCO or another regulated environment is an advantage.
• KCSE certificate with a minimum overall grade of C plain, including at least C plain in English and Mathematics.
• High integrity and discretion when handling sensitive member information, privileged access and security findings; strong analytical, troubleshooting, planning, documentation and communication skills are essential.
• Ability to explain technical risks in business terms, collaborate with varied stakeholders, work effectively during high-pressure incidents and keep current with cyber threats and regulatory expectations.
• The source specifies an age requirement of above 30 years.