Information Security Lead

About the role

The Information Security Lead will own BURN’s information security programme across cloud and on‑premise infrastructure, business applications, and the factory and field networks supporting IoT‑enabled products. Reporting to the Director of Information Systems, the role leads a small security function and collaborates closely with IT, NOC, and Engineering teams.

Key responsibilities

• Lead remediation of findings from external security assessments across network, web, mobile, and cloud environments.
• Define and deliver the information security roadmap, policies and standards, including data classification, DLP, access control and BYOD.
• Own identity and access management, including Microsoft Entra ID rollout, MFA, privileged access and role‑based access reviews.
• Secure AWS and on‑premise infrastructure, covering IAM, network segmentation, logging, CI/CD pipelines and infrastructure‑as‑code.
• Establish security monitoring, incident response and breach management, acting as technical lead during incidents and running annual breach simulations.
• Partner with Legal and Compliance to meet the Kenya Data Protection Act and other market data protection requirements.
• Govern vendor and third‑party access, including security due diligence and data processing agreements.
• Plan and coordinate vulnerability assessments and penetration testing, ensuring effective remediation.
• Support disaster recovery and backup testing, run security awareness for staff and coach team members.

Required profile

• Bachelor’s degree in computer science, engineering or related field.
• 7+ years experience in information or infrastructure security, with at least 2 years leading security initiatives or teams.
• Strong hands‑on experience securing cloud environments, particularly AWS.
• Experience with identity and access management, Microsoft Entra ID and Microsoft 365 security.
• Proven experience running vulnerability management and penetration testing programmes.
• Experience leading security incident response and building SIEM capabilities.
• Working knowledge of security frameworks (ISO 27001, NIST CSF, CIS Controls) and data protection regulations.
• Experience with infrastructure‑as‑code and securing CI/CD pipelines (Terraform, Ansible).
• Recognised security certification (CISSP, CISM, CCSP, OSCP, AWS Certified Security – Specialty) desirable.

Required skills

• AWS security (IAM, networking, logging)
• Microsoft Entra ID, MFA, privileged access management
• Identity and access management
• Vulnerability management and penetration testing
• Security incident response
• SIEM implementation
• Infrastructure‑as‑code (Terraform, Ansible)
• Security frameworks (ISO 27001, NIST CSF, CIS Controls)
• Data protection regulations (Kenya Data Protection Act)