Senior Officer, Cyber Secure by Design

Safaricom is the leading provider of converged communication solutions in Kenya. In addition to providing a broad range of first-class products and services for Telephony, Broadband Internet and Financial services, Safaricom seeks to uplift the welfare of Kenyans through value-added services and support for community projects.

Senior Officer, Cyber Secure by Design

Job Description

• Reporting to the Senior Manager, Cyber Secure by Design , the Senior Officer – Cyber Secure by Design will support Safaricom’s security assurance program by embedding security into all products, platforms, and services before go-live. The role will also provide timely security assurance reports and advice to the business when required, and within very tight timelines. The Senior Officer will also support other Cyber Secure by Design practices, including Red Teaming, bug bounty, and DevSecOps.

Responsibilities

Security Assurance for Projects

• Conduct periodic security reviews, vulnerability assessments & penetration tests across all of Safaricom’s systems/infrastructure

• Ensure all new and existing systems/products/services comply with Company’s security policies & standards and other industry best practices e.g. ISO27001, CIS and Kenya Data Protection Act

• Provide timely and quality security assurance reports and advice to the business when required even with very tight deadlines

• Do regular follow ups with system custodians/owners to ensure any security risks identified are addressed within the agreed timelines

• Define Cyber Security metrics and report periodically on security compliance across all networks/systems

• Bug Bounty Program Management

• Drive the remediation of the identified/reported bug bounty findings and integrate the learnings to different areas of application.

Red Teaming & Offensive Security

• Carry out red team exercises, providing input to scope, reviewing findings, and tracking remediation progress. Deliver insights on risks, while fostering purple team collaboration and continuous upskilling in offensive security.

• DevSecOps Strategy & Tooling Governance

• Ensure CI/CD pipelines integrate required security tools and practices. Carry out developer security training to embed secure coding practices.

Knowledge share

• Conduct knowledge share sessions on new areas of technology, bug bounty learning, read teaming findings within the squads and larger organization.

Research & Development

• Conduct research and development on emerging areas in security.

• Present findings for sensitization and knowledge transfer to other team members and staff.

Health & Safety