Cyber Security Administrator (Operations)

The Cyber Security Administrator is responsible for safeguarding Kenya Airways' information systems, digital assets, and supporting infrastructure through offensive security operations primarily conducting penetration testing, red team simulations, adversary emulation, and vulnerability assessments to proactively identify and exploit weaknesses before malicious actors do. The role demands a hands-on, attacker-minded professional who can think creatively, adapt to evolving threat landscapes, and translate complex technical findings into clear, actionable remediation guidance that strengthens the organization's overall security posture.

Responsibilities

Identify, assess, and manage cybersecurity risks through defensive analysis and offensive testing. This includes evaluating both internal and external threats and vulnerabilities.

Develop risk mitigation strategies informed by threat monitoring and incident analysis, prioritizing security investments to protect critical assets against evolving threats.

Develop and implement the system-wide Information Security function of the information security program to ensure information security risks are identified and monitored.

Continuously identify, assess, and monitor information security risks across the organization and escalating emerging threats to inform defensive priorities.

Collaborate with developers, Systems engineers, database engineers, security engineers, project managers, cybersecurity administrators and SOC analysts.

Implement and fine tune security monitoring solutions, including SIEM (Security Information and Event Management) systems, to detect and respond to security incidents.

Collaborate with internal teams to investigate and mitigate security breaches.

Triage, investigate, contain, eradicate, and recover from security incidents while coordinating with internal teams and external partners as required.

Lead incident investigations using data-driven analysis, coordinate response efforts, and implement corrective actions to prevent recurrence

Maintain and continuously improve incident response plans and playbooks for common attack scenarios.

Consume and operationalize threat intelligence feeds and adversary TTPs to proactively update detection rules, block emerging IOCs, and inform defensive priorities.

Deploy and maintain SOAR workflows to automate alert triage, enrichment, and routine response tasks reducing response times and analyst fatigue.

Oversee the deployment, configuration, and maintenance of security technologies, including EDR/XDR and encryption solutions among others.

Ensure all defensive systems are patched, updated, and operating at optimal performance with high availability.

Assist in executing vulnerability assessments, penetration tests, and adversary emulation exercises mapped to the MITRE ATT&CK framework to validate and stress-test defensive controls.

Collaborate with SOC analysts in purple team exercises and translate offensive findings into actionable defensive improvements.

Work with Internal Audit and External Audit consultants as appropriate on required security assessments and audits

Ensure all projects and systems are subjected to security checks to avert possible security threats pre and post go-live

Respond promptly to all system and network security breaches, ensuring containment, eradication, and recovery in line with documented procedures.

Implement automation (SOAR) within the organization to enable efficient alert triage, incident response workflows, and routine security operations.

Evaluate the organization’s security needs and establish defensive best practices, hardening baselines, and configuration standards accordingly.

Ensure the organization’s data and infrastructure are protected through layered, defense-in-depth security controls across network, endpoint, application, and data layers.

Assess the organization’s security posture through continuous monitoring, vulnerability scanning, and control validation.

Investigate breaches and incidents, conduct root cause analysis, and implement improvements to create ever more robust defensive protocols.

Skills

Excellent communication, interpersonal & problem-solving skills with the ability to work confidently on high-priority problems.

Strong analytical and critical-thinking skills with an attacker’s mindset.

Ability to handle pressure and difficult situations with resilience, calmly and effectively.

Must be a person of unquestionable integrity.

Self-motivated with a passion for continuous learning in cybersecurity.

Strong ethical standards and commitment to responsible disclosure practices.

Qualifications

Bachelor’s degree in information technology or another related field

3+ years of advanced IT skills with high level of information security experience and expertise (hands-on experience in defensive cybersecurity operations).

Proven hands-on experience in security monitoring, incident detection and response, and vulnerability management.

Proficiency with SIEM platforms and experience with vulnerability scanning and management tools

Experience in penetration testing, ethical hacking, and vulnerability assessments

Familiarity with security auditing processes

Well versed with Linux commands, scripting as well as windows security controls adoption

Ability to set up systems to identify intrusions, configuring these to suit the needs of the organization

Strong knowledge of networking protocols and common attack vectors.

Experience performing information security audits or risk assessments

Industry certifications highly preferred: CEH, CDSA CISSP, SSCP or equivalent defensive and offensive security certifications.

Knowledge of securing network technologies, applications, and operating systems.

Experience responding to, analyzing, and communicating information security incidents and performing forensic

Excellent interpersonal, communication, and presentation skills, including formal report writing experience

Understanding of common security standards and regulations relating to a higher education environment (e.g., PCI DSS, NIST, ISO27001, GDPR, IOSA etc.)

Capable of enforcing security best practices in line with the National Institute of Standards and Technology.