Cyber Security Analyst (DevSecOps) - 1-Year Fixed Term

About the role

A leading financial services institution in Kenya, operating in a highly regulated and technology-driven environment, is hiring a Cyber Security Analyst (DevSecOps) on a 1-year fixed-term contract. The analyst embeds security controls across the software development lifecycle and works with scrum teams, developers, infrastructure teams and project stakeholders so that deployed systems meet the bank's cybersecurity policies, regulatory requirements and industry standards.

Key responsibilities

• Work with scrum and project teams to capture security requirements early and provide input into secure architecture and solution design
• Promote secure coding standards, application security testing and secure configuration management across mobile apps, web apps, APIs, microservices, servers, databases, cloud infrastructure, containers and networks
• Coordinate vulnerability assessments and penetration testing, review DevSecOps tool reports and follow up on vulnerabilities to closure
• Monitor security checks in deployment pipelines and take part in deployment sessions and post-implementation reviews
• Support access management based on least privilege, define user access matrices and support compliance with PCI DSS, ISO 27001 and SABSA
• Identify security incidents and policy violations, coordinate responses and report regularly to the Cybersecurity Project Lead, project teams and steering committees

Required profile

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity or another STEM field; a Master's in Information Security or Cybersecurity is an added advantage
• Minimum 3 years of experience in technology-related roles, including at least 1 year in information security and 1 year in application security, secure SDLC or DevSecOps
• Experience supporting technology implementation projects and user training initiatives

Required skills

• Experience with DevSecOps and automation tools such as Ansible, Jenkins, GitLab, Azure DevOps, Trivy, SonarQube, Terraform, Git or similar
• Familiarity with API, container and cloud security environments
• Added advantage: certifications such as CISA, CISM, CISSP, Security+, CEH, OSCP, etc.