ICT Security Manager

The ICT Security Manager is responsible for establishing, operating and continuously improving Tower SACCO’s information and cybersecurity controls across infrastructure, applications, digital channels, data, endpoints, networks and third-party integrations. The position combines cybersecurity governance, security operations, vulnerability management and ethical testing, identity and access management, application and API security, incident response, technology risk management, regulatory compliance and vendor security oversight.

PREFERRED QUALIFICATIONS

Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, Information Systems or a related field.

Professional certification in information/cybersecurity such as CISM, CISSP, CISA, CEH, CCNA Cybersecurity/Cyber Ops, CCSP or an equivalent recognized certification. A combination of governance and hands-on technical security certification is an added advantage.

Minimum five (5) years of relevant ICT experience, with at least three (3) years of demonstrable responsibility in information/cybersecurity, security operations, infrastructure security, technology risk or related functions.

Practical experience securing enterprise networks, Windows/Linux servers, Active Directory, databases, virtualization environments, endpoints, firewalls/VPNs and business applications.

Experience in vulnerability assessment, penetration testing, incident response, access-control reviews and remediation management.

Experience within financial services, SACCOs, banking, payments or another regulated environment is a strong advantage.

Working knowledge of recognized security frameworks and good practice such as ISO/IEC 27001,

NIST Cybersecurity Framework, CIS Controls and OWASP principles is desirable.

KCSE minimum qualifications: (C Plain) with C (plain) in English and Mathematics

PERSON SPECIFICATIONS

Age above 30 years.

High integrity, discretion and strong ethical standards when handling privileged access, security information and sensitive member data.

Strong analytical, critical-thinking, problem-solving and troubleshooting capability, including performance under high-pressure incident situations.

Ability to translate technical risks into clear business impact, priorities and actionable recommendations for management and non-technical stakeholders.

Strong knowledge of authentication, authorization, security administration, network and application security, operating-system hardening and vulnerability management.

Understanding of ethical hacking, threat modelling, attack paths and defensive controls, with disciplined adherence to approved scope and responsible disclosure practices.

Strong interpersonal and stakeholder-management skills with the ability to work effectively across

ICT, Risk, Internal Audit, business departments and external vendors.

Good planning, documentation and reporting skills, with the discipline to maintain evidence, registers, remediation trackers and security procedures.

Continuous-learning mindset and ability to keep abreast of emerging cyber threats, technologies and regulatory expectations.