Job Summary
Safaricom Ethiopia is seeking an experienced cybersecurity professional to lead its Cyber Prevent sub-function, overseeing enterprise security infrastructure, preventive controls, patch and vulnerability management, privileged access, and cryptographic governance. The role is responsible for ensuring the effectiveness, resilience, and compliance of security controls across the organization, managing technology lifecycles, vendors, budgets, and team development. The successful candidate will drive cross-functional security initiatives, strengthen risk management, and ensure compliance with Group and regulatory requirements while protecting the organization’s technology infrastructure and critical systems.
Responsibilities
Preventive Control Estate & Cyber Security Infrastructure Ownership
Own the design, availability, capacity, resilience and effectiveness of preventive controls across endpoint, privileged access, host-based detection, network, perimeter, cryptographic and management platforms.
Own the enterprise privileged access control position: approve the privileged access standard, elevation and break-glass model, session recording policy and the scope and sequencing of PAM onboarding across the estate, and assure it to audit, Group and regulator.
Own service levels, operational governance, control performance and change quality across the Cyber Prevent estate.
Enterprise Patch & Vulnerability Management Program
Own the enterprise patch and vulnerability management programme end to end, including policy, SLAs, risk-based prioritization, exception governance and executive reporting.
Drive remediation accountability across IT, Network, M-PESA and application owners, escalating aged critical exposure to Exco where required.
Key Management & Cryptographic Governance
Own the enterprise key management and cryptographic control position: approve cryptographic policy and certificate policy, authorize key ceremonies and HSM operations, and assure cryptographic compliance to audit, Group and regulator.
Technology Lifecycle, Vendor & Commercial Governance
Own the lifecycle of security products including WAF, CA/PKI, HSM, anti-DDoS, firewalls, PAM, EDR and NAC; direct requirements definition, technical evaluation and vendor selection with Cyber Architecture.
Govern OEM and managed service performance, licensing and renewals.
Control Effectiveness Assurance & Cross-Functional Delivery
Own the Cyber Prevent operational and control-effectiveness metric set.
Validate preventive control effectiveness through purple-team exercises, control testing and performance metrics.
Own the remediation of validated control gaps.
Lead cross-functional programs such as segmentation, hardening and certificate automation.
Ensure Group CHARM and regulatory requirements are met and demonstrate their operating effectiveness.
Team Leadership, Resourcing & Capability Development
Lead, resources and develop the Cyber Prevent sub-function across endpoint security and network security domains.
Own competency pathways, certification planning, on-call and standby arrangements, succession planning and retention.
Budget & Financial Management
Own the Cyber Prevent operational and capital budget jointly with the EHOD, including licenses, support contracts, managed services and technology refresh; manage forecasting, spend control and benefit realization.
Decision ownership:
Decides: the preventive control target state, service levels and technology roadmap for the sub-function, and the approval of cryptographic and certificate policy.
Decides: authorization of key ceremonies and HSM operations, patch and vulnerability SLAs, and the granting or refusal of exceptions and risk acceptances within delegated authority.
Decides: vendor selection recommendation, license and renewal commitments within the approved budget, and the deployment of sub-function resources.
Recommends: investment cases, structure and band changes, and cross-functional remediation mandates for EHOD and Exco approval.
Escalates: aged critical exposure that owners will not remediate, cryptographic compromise, and control failures with enterprise or regulatory consequence, to the EHOD, Risk Committee and Exco.
Accountable to: the EHOD for the effectiveness, cost and continuity of the preventive control estate.
Qualifications
Must have technical / professional qualifications:
BSc in Computer Science, Computer Engineering, Electrical Engineering, IT, Telecommunications Engineering or a related discipline.
7+ years in infrastructure, network or endpoint security, including at least 4 years leading a security operations, infrastructure security or vulnerability management team in a large enterprise or telecom operator.
CISSP or CISM, together with an advanced infrastructure or network security certification.
Demonstrated ownership of an enterprise patch and vulnerability management program, including SLA and exception governance.
Proven budget ownership, vendor and OEM commercial governance and technology lifecycle management.
Track record of driving remediation accountability across teams outside the direct reporting line.
Desired
MSc in Cyber Security, Information Security or a management discipline.
CCIE Security, PCNSE, Fortinet NSE 7/8, GDSA, CCSP or SABSA.
ITIL Expert, CRISC, PMP or PRINCE2.
Experience of PKI and cryptographic governance in a mobile money or payments environment.
Apply for this Job