Senior Officer, Cyber Secure by Design

Role Overview

The Senior Officer, Cyber Secure by Design helps Safaricom identify and reduce security risks in products, platforms, infrastructure, and services before they go live. Reporting to the Senior Manager, Cyber Secure by Design, you will assess systems, advise teams under demanding deadlines, and follow through on remediation while contributing to offensive security, bug bounty, and DevSecOps practices.

Key Responsibilities

• Review projects and existing systems through security assessments, vulnerability testing, penetration testing, and pre- and post-implementation reviews.
• Check that technology and services meet internal security requirements and relevant benchmarks, including ISO 27001, CIS guidance, and Kenya’s data protection law.
• Prepare clear, timely assurance findings and recommendations, and work with system owners to resolve identified risks within agreed timeframes.
• Track security compliance across networks and systems by defining relevant measures and reporting results regularly.
• Coordinate remediation of vulnerabilities reported through the bug bounty programme and share lessons from findings with product and engineering teams.
• Contribute to red team exercises by helping shape scope, assessing results, tracking corrective actions, and encouraging collaboration between offensive and defensive security teams.
• Promote secure development by supporting security controls in CI/CD pipelines and delivering developer training on secure coding.
• Research emerging security topics and share practical findings through presentations and knowledge-sharing sessions with teams and colleagues.

Requirements & Qualifications

• A degree in information security, computer forensics, computer science, information technology, or a related technical discipline.
• At least three years of information systems security experience, such as ethical hacking, penetration testing, vulnerability assessment, ICT audit, or implementation reviews.
• At least three years of experience with networks and operating systems, including technologies such as Cisco, Huawei, Windows, Unix, or Linux.
• At least three years working with web or mobile application technologies, such as Java, Python, PHP, JavaScript, CSS, Apache, Nginx, or IIS.
• Practical ability to administer and use ethical hacking tools, for example Kali Linux, Metasploit, Nexpose, Nessus, Nmap, and Burp Suite.
• Relevant security certifications such as CEH, CISSP, CISM, CISA, GIAC, CPTP, or OSCP. Networking credentials such as CCNA, CCNP, or CCSP are preferred; Microsoft Windows and Linux/Unix certifications are also relevant.
• Working knowledge of databases such as Oracle, Microsoft SQL Server, MongoDB, or PostgreSQL is an advantage.
• Experience with virtualization, containers, microservices, or DevSecOps tooling—such as VMware, OpenShift, Kubernetes, Docker, Jenkins, Jira, GitHub, or GitLab—is an advantage.
• Familiarity with mobile and GSM technologies, including Android, iOS, 2G, 3G, LTE, or USSD, is an advantage.
• Experience working in squads or tribes and helping engineering, operations, cloud, and digital product teams adopt security automation.
• Strong analytical attention to detail, communication, teamwork, time management, report-writing, and presentation skills, with a customer-focused approach.

What We Offer / Why Join

The role offers the opportunity to influence security across a broad range of digital products and infrastructure, while working with delivery teams on assurance, offensive security, and secure development practices.