IT Security Manager

CIC Insurance Group Plc is a Kenyan insurance and financial services provider, established in 1968. It operates in the banking, financial services, and insurance sectors, offering a range of products and services.

This role involves protecting the organization's information assets, technology infrastructure, applications, and digital services from cyber and information security threats. The manager provides strategic direction and hands-on leadership in implementing, monitoring, and continuously improving information security controls. They ensure compliance with applicable regulatory requirements, company policies, and recognized security frameworks like ISO/IEC 27001 and NIST. The role requires close collaboration with IT, Risk, Internal Audit, business teams, project teams, and external partners to integrate security-by-design principles into technology initiatives, proactively manage cyber risks, and enhance the organization’s overall cyber resilience.

1. Manage and continuously improve the organization's information security infrastructure and controls, including firewalls, IDS/IPS, endpoint protection/EDR, PAM, NAC, patch and vulnerability management, and cloud security controls across AWS and Microsoft Azure.
2. Lead the technology security assessment program, covering vulnerability assessments, penetration testing, security reviews, configuration assessments, and risk assessments.
3. Develop, review, implement, and enforce information security policies, standards, procedures, and guidelines, ensuring alignment with business requirements, regulatory obligations, and industry standards.
4. Develop and deliver a comprehensive information security and cybersecurity awareness program, conducting regular campaigns on topics like phishing, social engineering, password security, data protection, remote working, acceptable use, and emerging cyber threats.
5. Collaborate with project teams, IT managers, architects, developers, and business stakeholders to embed security-by-design principles throughout the technology lifecycle.
6. Provide security architecture guidance and recommendations for new systems, applications, integrations, infrastructure, and cloud initiatives.
7. Monitor the evolving cyber threat landscape and assess its potential impact on the organization.
8. Lead and coordinate the cybersecurity incident response lifecycle, from detection and identification to investigation, analysis, containment, eradication, recovery, and post-incident review.
9. Provide cybersecurity oversight for business continuity and disaster recovery programs.
10. Establish and monitor security patching and vulnerability remediation requirements across technology platforms.
11. Establish and maintain effective relationships with cybersecurity and technology security vendors.
12. Prepare regular information security reports and dashboards for the Group Head of IT and other relevant management forums.

1. Hold a Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a related field.
2. Possess relevant professional qualifications such as CISA, CISM, CISP, CEH, or similar. Additional certifications in AWS, Azure, and GCP are advantageous.
3. Have a minimum of seven (7) years of hands-on IT security experience.
4. Include at least two (2) years of experience in a team leadership role.
5. Demonstrate experience within the financial services industry.
6. Show proven experience in conducting penetration tests and vulnerability assessments, and leading the closure of findings through collaboration with internal and external IT auditors, risk, and compliance departments.
7. Exhibit strong knowledge of security frameworks and standards, such as ISO 27001 and NIST.
8. Be skilled in IT risk management, cyber threat mitigation, and hands-on problem-solving with strong analytical abilities.
9. Possess proven leadership and communication skills for cross-functional teams.
10. Be a strategic, adaptable, and budget-conscious decision-maker, capable of aligning security initiatives with business objectives and managing vendor relations effectively.