About this role

The Information Security Lead will own BURN’s information security programme across cloud and on-premise infrastructure, business applications, and the factory and field networks that support our IoT-enabled products. They will lead remediation of known security gaps, establish identity, data protection, and third-party access controls, and build the policies, monitoring, and incident response capability BURN needs to grow securely across its markets. Reporting to the Director of Information Systems, they will coach a small security function and work closely with IT, NOC, and Engineering.

Duties and Responsibilities:

Lead remediation of findings from external security assessments across network, web, mobile, and cloud environments, tracking closure against risk-based timelines.
Define and deliver the information security roadmap, policies, and standards, including data classification, data loss prevention (DLP), access control, and BYOD.
Own identity and access management, including the Microsoft Entra ID rollout, MFA, privileged access, and periodic role-based access reviews across ERP and internal business systems.
Secure AWS and on-premise infrastructure, including IAM, network segmentation, logging, CI/CD pipelines, and infrastructure-as-code.
Establish security monitoring, incident response, and breach management, acting as technical lead during security incidents and running an annual breach simulation.
Partner with Legal and Compliance to meet the Kenya Data Protection Act and data protection requirements in other markets, including data retention and data subject rights.
Govern vendor and third-party access, including security due diligence and data processing agreements for suppliers and platform partners.
Plan and coordinate vulnerability assessments and penetration testing, and verify that fixes are effective.
Support disaster recovery and backup testing with IT, run security awareness for staff, and coach team members developing cybersecurity skills.

Requirements (E – essential, D – desirable):

Bachelor’s degree in computer science, engineering, or a related field. (D)
7+ years of experience in information or infrastructure security, including at least 2 years leading security initiatives or teams. (E)
Strong hands-on experience securing cloud environments, particularly AWS, including IAM, networking, and logging. (E)
Experience with identity and access management, including Microsoft Entra ID and Microsoft 365 security, MFA, and privileged access. (E)
Proven experience running vulnerability management and penetration testing programmes, and driving remediation with engineering and IT teams. (E)
Experience leading security incident response and building security monitoring and logging capability (SIEM or equivalent). (E)
Working knowledge of security frameworks (e.g., ISO 27001, NIST CSF, CIS Controls) and data protection regulation, including the Kenya Data Protection Act 2019, with experience writing policies and standards. (E)
Experience with infrastructure-as-code and securing CI/CD pipelines (e.g., Terraform, Ansible). (D)
Experience securing manufacturing, OT, or IoT environments. (D)
Ability to explain security risk clearly to technical and non-technical audiences, including senior leadership. (E)
Strong stakeholder management, problem-solving, and collaboration skills. (E)
Recognised security certification (e.g., CISSP, CISM, CCSP, OSCP, AWS Certified Security – Specialty). (D)

Check how your CV matches this job

Information Security Lead