ICT Security Manager

Tower Sacco is a Savings and Credit Co-operative (SACCO) based in Kenya, providing a range of financial services to its members.

This role involves a comprehensive approach to cybersecurity, covering governance, risk, and compliance by developing and maintaining the SACCO's Information Security Management framework and ensuring adherence to Kenyan legal and regulatory requirements like the Data Protection Act, 2019. The manager will oversee security operations and infrastructure protection, including the configuration and monitoring of servers, endpoints, databases, and network infrastructure, as well as administering security controls for firewalls, VPNs, and anti-malware systems. Key responsibilities also include managing identity, access, and privileged access across Active Directory and business applications, enforcing least privilege and multi-factor authentication. The role ensures application, digital channel, and API security by embedding security in system development and conducting security reviews and penetration tests for critical platforms. A risk-based vulnerability management program will be established, covering internal and external assets, with findings prioritized and tracked for remediation. The manager will lead technical responses to cybersecurity incidents, maintain incident-response procedures, and ensure cybersecurity requirements are integrated into business continuity and disaster recovery plans. Furthermore, the role involves assessing cybersecurity risks from third-party vendors, defining minimum security requirements for technology procurements, and monitoring vendor access. Finally, the manager will implement controls to protect member and employee data, coordinate cybersecurity awareness initiatives, and provide security guidance to ICT and business teams.

1. Develop, implement, and maintain the SACCO’s Information Security Management framework, policies, standards, and procedures.
2. Ensure compliance with Kenyan legal and regulatory requirements, including the Data Protection Act,
3. Oversee security configuration, monitoring, and hardening of servers, endpoints, databases, and network infrastructure.
4. Administer and review security controls for firewalls, VPNs, WAN connectivity, endpoint protection, and email security.
5. Ensure secure configuration of Windows Server, Oracle Linux, Oracle database environments, and VMware infrastructure.
6. Oversee identity and access security across Active Directory and business applications, including joiner-mover-leaver controls and periodic access reviews.
7. Enforce least privilege, segregation of duties, and multi-factor authentication for critical systems.
8. Lead the implementation and continuous improvement of privileged access management (PAM) and network access control (NAC).
9. Embed security in the acquisition, development, configuration, integration, testing, and deployment of ICT systems.
10. Conduct or coordinate security reviews, vulnerability assessments, and penetration tests for core banking, mobile banking, internet banking, and other critical platforms.
11. Assess API and integration security, including authentication, authorization, and data handling.
12. Establish a risk-based vulnerability management program covering internal and external assets.
13. Conduct or coordinate vulnerability assessments, penetration testing, and configuration reviews.
14. Validate and prioritize security findings, assign remediation actions, and track them to closure.
15. Lead the technical response to cybersecurity incidents, including detection, containment, eradication, and root-cause analysis.
16. Maintain and test cybersecurity incident-response procedures and escalation paths.
17. Ensure cybersecurity requirements are incorporated into business continuity, backup, and disaster-recovery arrangements.
18. Participate in DR/failover exercises and verify security controls during failover and failback.
19. Assess cybersecurity risks from core banking, channel, network, cloud, hardware, software, and other technology vendors.
20. Define minimum security requirements for technology procurements, contracts, and integrations.
21. Monitor vendor remote access and privileged support activities.
22. Implement and monitor controls to protect member, employee, and SACCO information from unauthorized disclosure or loss.
23. Coordinate cybersecurity awareness initiatives, phishing simulations, and staff sensitization.
24. Provide practical security guidance to ICT and business teams and promote timely reporting of suspicious activity.

1. Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, Information Systems, or a related field.
2. Professional certification in information/cybersecurity such as CISM, CISSP, CISA, CEH, CCNA Cybersecurity/Cyber Ops, or CCSP; a combination of governance and hands-on technical security certification is an added advantage.
3. Minimum five (5) years of relevant ICT experience, with at least three (3) years of demonstrable responsibility in information/cybersecurity, security operations, infrastructure security, or technology risk functions.
4. Practical experience securing enterprise networks, Windows/Linux servers, Active Directory, databases, virtualization environments, endpoints, firewalls/VPNs, and business applications.
5. Experience in vulnerability assessment, penetration testing, incident response, access-control reviews, and remediation management.
6. Experience within financial services, SACCOs, banking, payments, or another regulated environment is a strong advantage.
7. Working knowledge of recognized security frameworks and good practices such as ISO/IEC 27001, NIST Cybersecurity Framework, CIS Controls, and OWASP principles is desirable.
8. KCSE minimum qualifications: C Plain overall, with C Plain in English and Mathematics.
9. Age above 30 years.
10. High integrity, discretion, and strong ethical standards when handling privileged access, security information, and sensitive member data.
11. Strong analytical, critical-thinking, problem-solving, and troubleshooting capabilities, including performance under high-pressure incident situations.
12. Ability to translate technical risks into clear business impact, priorities, and actionable recommendations for management and non-technical stakeholders.
13. Strong knowledge of authentication, authorization, security administration, network and application security, operating-system hardening, and vulnerability management.
14. Understanding of ethical hacking, threat modeling, attack paths, and defensive controls, with disciplined adherence to approved scope and responsible disclosure practices.
15. Strong interpersonal and stakeholder-management skills with the ability to work effectively across ICT, Risk, Internal Audit, business departments, and external vendors.
16. Good planning, documentation, and reporting skills, with the discipline to maintain evidence, registers, remediation trackers, and security procedures.
17. Continuous-learning mindset and ability to keep abreast of emerging cyber threats, technologies, and regulatory expectations.