Safaricom is the leading provider of converged communication solutions in Kenya. In addition to providing a broad range of first-class products and services for Telephony, Broadband Internet and Financial services, Safaricom seeks to uplift the welfare of Kenyans through value-added services and support for community projects.

Job Description

Reporting to the Senior Manager, Cyber Secure by Design , the Senior Officer – Cyber Secure by Design will support Safaricom’s security assurance program by embedding security into all products, platforms, and services before go-live. The role will also provide timely security assurance reports and advice to the business when required, and within very tight timelines. The Senior Officer will also support other Cyber Secure by Design practices, including Red Teaming, bug bounty, and DevSecOps.

Responsibilities

Security Assurance for Projects

• Conduct periodic security reviews, vulnerability assessments & penetration tests across all of Safaricom’s systems/infrastructure
• Ensure all new and existing systems/products/services comply with Company's security policies & standards and other industry best practices e.g. ISO27001, CIS and Kenya Data Protection Act
• Provide timely and quality security assurance reports and advice to the business when required even with very tight deadlines
• Do regular follow ups with system custodians/owners to ensure any security risks identified are addressed within the agreed timelines
• Define Cyber Security metrics and report periodically on security compliance across all networks/systems

Bug Bounty Program Management

• Drive the remediation of the identified/reported bug bounty findings and integrate the learnings to different areas of application.

Red Teaming & Offensive Security

• Carry out red team exercises, providing input to scope, reviewing findings, and tracking remediation progress. Deliver insights on risks, while fostering purple team collaboration and continuous upskilling in offensive security.

DevSecOps Strategy & Tooling Governance

• Ensure CI/CD pipelines integrate required security tools and practices. Carry out developer security training to embed secure coding practices.

Knowledge share

• Conduct knowledge share sessions on new areas of technology, bug bounty learning, read teaming findings within the squads and larger organization.

Research & Development

• Conduct research and development on emerging areas in security.
• Present findings for sensitization and knowledge transfer to other team members and staff.

Health & Safety

• Uphold the company code of conduct, policies and procedures, ensuring integrity and accountability in every aspect of your work
• All employees have a responsibility to adhere to safety, health, and wellbeing policies.

Qualifications

• Degree in Information Security/Computer Forensics/Computer Science/Information Technology or other relevant Technical Degree
• Information security certifications e.g. CEH/CISSP/CISM/CISA/GIAC/CPTP/OSCP
• Networking certifications: CCNA/CCNP/CCSP are also preferred
• Certifications in Microsoft Windows and Linux/Unix Operating Systems
• Demonstrate competency in the use and administration of ethical hacking tools e.g. KALI Linux, Metasploit, Nexpose, Nessus, Nmap, Burp Suite etc.
• Minimum of 3 years’ working experience in Information Systems Security – e.g. Ethical Hacking, Penetration Testing, Vulnerability Assessments, ICT Audits, Pre-and-Post Implementation System Reviews etc.
• Minimum of 3 years’ working experience in Networking and Operating Systems e.g. Cisco, Huawei, Windows (All), Unix, Linux etc.
• Minimum of 3 years’ working experience in Web and Mobile applications technologies e.g. Java, Python, PHP, Javascript, CSS, Apache, Nginx, IIS etc.
• Working knowledge of databases e.g. Oracle, MSSQL, MongoDB, Postgres etc. will be an added advantage
• Working knowledge of Virtualization & Microservices technologies e.g. VMware, Open shift, Kubernetes, Docker etc. will be an added advantage
• Working knowledge and experience in DevSecOps technologies and practices i.e. Jenkins, Jira, GitHub, Gitlab etc. will be an added advantage
• Working knowledge of Mobile and GSM technologies e.g. Android, IOS, 2G, 3G, LTE, USSD etc. will be an added advantage
• Experience operating within squads/tribes, driving security automation adoption across engineering, operations, cloud, and digital product teams.
• Excellent communication skills and a good team player
• Excellent time management skills i.e. getting things done in a timely manner
• Excellent report writing and presentation skills
• Very analytical and keen on details
• Customer obsessed

• Conduct periodic security reviews, vulnerability assessments & penetration tests across all of Safaricom’s systems/infrastructure
• Ensure all new and existing systems/products/services comply with Company's security policies & standards and other industry best practices e.g. ISO27001, CIS and Kenya Data Protection Act
• Provide timely and quality security assurance reports and advice to the business when required even with very tight deadlines
• Do regular follow ups with system custodians/owners to ensure any security risks identified are addressed within the agreed timelines
• Define Cyber Security metrics and report periodically on security compliance across all networks/systems
• Drive the remediation of the identified/reported bug bounty findings and integrate the learnings to different areas of application.
• Carry out red team exercises, providing input to scope, reviewing findings, and tracking remediation progress. Deliver insights on risks, while fostering purple team collaboration and continuous upskilling in offensive security.
• Ensure CI/CD pipelines integrate required security tools and practices. Carry out developer security training to embed secure coding practices.
• Conduct knowledge share sessions on new areas of technology, bug bounty learning, read teaming findings within the squads and larger organization.
• Conduct research and development on emerging areas in security.
• Present findings for sensitization and knowledge transfer to other team members and staff.
• Uphold the company code of conduct, policies and procedures, ensuring integrity and accountability in every aspect of your work
• All employees have a responsibility to adhere to safety, health, and wellbeing policies.

• Information Security
• Computer Forensics
• Computer Science
• Information Technology
• CEH
• CISSP
• CISM
• CISA
• GIAC
• CPTP
• OSCP
• CCNA
• CCNP
• CCSP
• Microsoft Windows
• Linux/Unix Operating Systems
• KALI Linux
• Metasploit
• Nexpose
• Nessus
• Nmap
• Burp Suite
• Ethical Hacking
• Penetration Testing
• Vulnerability Assessments
• ICT Audits
• Pre-and-Post Implementation System Reviews
• Cisco
• Huawei
• Windows
• Unix
• Linux
• Java
• Python
• PHP
• Javascript
• CSS
• Apache
• Nginx
• IIS
• Oracle
• MSSQL
• MongoDB
• Postgres
• VMware
• Open shift
• Kubernetes
• Docker
• Jenkins
• Jira
• GitHub
• Gitlab
• Android
• IOS
• 2G
• 3G
• LTE
• USSD
• Communication skills
• Team player
• Time management skills
• Report writing skills
• Presentation skills
• Analytical skills
• Customer obsessed

• Degree in Information Security/Computer Forensics/Computer Science/Information Technology or other relevant Technical Degree
• Information security certifications e.g. CEH/CISSP/CISM/CISA/GIAC/CPTP/OSCP
• Networking certifications: CCNA/CCNP/CCSP are also preferred
• Certifications in Microsoft Windows and Linux/Unix Operating Systems
• Demonstrate competency in the use and administration of ethical hacking tools e.g. KALI Linux, Metasploit, Nexpose, Nessus, Nmap, Burp Suite etc.
• Minimum of 3 years’ working experience in Information Systems Security – e.g. Ethical Hacking, Penetration Testing, Vulnerability Assessments, ICT Audits, Pre-and-Post Implementation System Reviews etc.
• Minimum of 3 years’ working experience in Networking and Operating Systems e.g. Cisco, Huawei, Windows (All), Unix, Linux etc.
• Minimum of 3 years’ working experience in Web and Mobile applications technologies e.g. Java, Python, PHP, Javascript, CSS, Apache, Nginx, IIS etc.
• Working knowledge of databases e.g. Oracle, MSSQL, MongoDB, Postgres etc. will be an added advantage
• Working knowledge of Virtualization & Microservices technologies e.g. VMware, Open shift, Kubernetes, Docker etc. will be an added advantage
• Working knowledge and experience in DevSecOps technologies and practices i.e. Jenkins, Jira, GitHub, Gitlab etc. will be an added advantage
• Working knowledge of Mobile and GSM technologies e.g. Android, IOS, 2G, 3G, LTE, USSD etc. will be an added advantage
• Experience operating within squads/tribes, driving security automation adoption across engineering, operations, cloud, and digital product teams.
• Excellent communication skills and a good team player
• Excellent time management skills i.e. getting things done in a timely manner
• Excellent report writing and presentation skills
• Very analytical and keen on details
• Customer obsessed