Tower Sacco was founded in 1976 by a group of primary school teachers in Ol'Kalou, Kenya. The sacco was established to provide its members with a safe and convenient place to save their money, as well as access to affordable loans. Over the years, Tower Sacco has grown to become one of the largest and most successful saccos in Kenya, with a membership of ove...

JOB PURPOSE

The ICT Security Manager is responsible for establishing, operating and continuously improving Tower SACCO’s information and cybersecurity controls across infrastructure, applications, digital channels, data, endpoints, networks and third-party integrations. The position combines cybersecurity governance, security operations, vulnerability management and ethical testing, identity and access management, application and API security, incident response, technology risk management, regulatory compliance and vendor security oversight.

PREFERRED QUALIFICATIONS

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, Information Systems or a related field.
• Professional certification in information/cybersecurity such as CISM, CISSP, CISA, CEH, CCNA Cybersecurity/Cyber Ops, CCSP or an equivalent recognized certification. A combination of governance and hands-on technical security certification is an added advantage.
• Minimum five (5) years of relevant ICT experience, with at least three (3) years of demonstrable responsibility in information/cybersecurity, security operations, infrastructure security, technology risk or related functions.
• Practical experience securing enterprise networks, Windows/Linux servers, Active Directory, databases, virtualization environments, endpoints, firewalls/VPNs and business applications.
• Experience in vulnerability assessment, penetration testing, incident response, access-control reviews and remediation management.
• Experience within financial services, SACCOs, banking, payments or another regulated environment is a strong advantage.
• Working knowledge of recognized security frameworks and good practice such as ISO/IEC 27001, NIST Cybersecurity Framework, CIS Controls and OWASP principles is desirable.
• KCSE minimum qualifications: (C Plain) with C (plain) in English and Mathematics

PERSON SPECIFICATIONS

• Age above 30 years.
• High integrity, discretion and strong ethical standards when handling privileged access, security information and sensitive member data.
• Strong analytical, critical-thinking, problem-solving and troubleshooting capability, including performance under high-pressure incident situations.
• Ability to translate technical risks into clear business impact, priorities and actionable recommendations for management and non-technical stakeholders.
• Strong knowledge of authentication, authorization, security administration, network and application security, operating-system hardening and vulnerability management.
• Understanding of ethical hacking, threat modelling, attack paths and defensive controls, with disciplined adherence to approved scope and responsible disclosure practices.
• Strong interpersonal and stakeholder-management skills with the ability to work effectively across ICT, Risk, Internal Audit, business departments and external vendors.
• Good planning, documentation and reporting skills, with the discipline to maintain evidence, registers, remediation trackers and security procedures.
• Continuous-learning mindset and ability to keep abreast of emerging cyber threats, technologies and regulatory expectations.

• Establishing, operating and continuously improving Tower SACCO’s information and cybersecurity controls across infrastructure, applications, digital channels, data, endpoints, networks and third-party integrations.
• Cybersecurity governance, security operations, vulnerability management and ethical testing, identity and access management, application and API security, incident response, technology risk management, regulatory compliance and vendor security oversight.

• Securing enterprise networks
• Windows/Linux servers
• Active Directory
• Databases
• Virtualization environments
• Endpoints
• Firewalls/VPNs
• Business applications
• Vulnerability assessment
• Penetration testing
• Incident response
• Access-control reviews
• Remediation management
• ISO/IEC 27001
• NIST Cybersecurity Framework
• CIS Controls
• OWASP principles
• Authentication
• Authorization
• Security administration
• Network security
• Application security
• Operating-system hardening
• Vulnerability management
• Ethical hacking
• Threat modelling
• Attack paths
• Defensive controls
• Stakeholder management
• Planning
• Documentation
• Reporting

• BA/BSc/HND
• Professional Certificate
• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, Information Systems or a related field.
• Professional certification in information/cybersecurity such as CISM, CISSP, CISA, CEH, CCNA Cybersecurity/Cyber Ops, CCSP or an equivalent recognized certification.
• KCSE minimum qualifications: (C Plain) with C (plain) in English and Mathematics