Information Security Lead

About the Role

The Information Security Lead will own BURN’s information security programme across cloud and on-premise infrastructure, business applications, and the factory and field networks that support our IoT-enabled products. They will lead remediation of known security gaps, establish identity, data protection, and third-party access controls, and build the policies, monitoring, and incident response capability BURN needs to grow securely across its markets. Reporting to the Director of Information Systems, they will coach a small security function and work closely with IT, NOC, and Engineering.

Duties and Responsibilities:

• Lead remediation of findings from external security assessments across network, web, mobile, and cloud environments, tracking closure against risk-based timelines.
• Define and deliver the information security roadmap, policies, and standards, including data classification, data loss prevention (DLP), access control, and BYOD.
• Own identity and access management, including the Microsoft Entra ID rollout, MFA, privileged access, and periodic role-based access reviews across ERP and internal business systems.
• Secure AWS and on-premise infrastructure, including IAM, network segmentation, logging, CI/CD pipelines, and infrastructure-as-code.
• Establish security monitoring, incident response, and breach management, acting as technical lead during security incidents and running an annual breach simulation.
• Partner with Legal and Compliance to meet the Kenya Data Protection Act and data protection requirements in other markets, including data retention and data subject rights.
• Govern vendor and third-party access, including security due diligence and data processing agreements for suppliers and platform partners.
• Plan and coordinate vulnerability assessments and penetration testing, and verify that fixes are effective.
• Support disaster recovery and backup testing with IT, run security awareness for staff, and coach team members developing cybersecurity skills.

Requirements (E – essential, D – desirable):

• Bachelor’s degree in computer science, engineering, or a related field. (D)
• 7+ years of experience in information or infrastructure security, including at least 2 years leading security initiatives or teams. (E)
• Strong hands-on experience securing cloud environments, particularly AWS, including IAM, networking, and logging. (E)
• Experience with identity and access management, including Microsoft Entra ID and Microsoft 365 security, MFA, and privileged access. (E)
• Proven experience running vulnerability management and penetration testing programmes, and driving remediation with engineering and IT teams. (E)
• Experience leading security incident response and building security monitoring and logging capability (SIEM or equivalent). (E)
• Working knowledge of security frameworks (e.g., ISO 27001, NIST CSF, CIS Controls) and data protection regulation, including the Kenya Data Protection Act 2019, with experience writing policies and standards. (E)
• Experience with infrastructure-as-code and securing CI/CD pipelines (e.g., Terraform, Ansible). (D)
• Experience securing manufacturing, OT, or IoT environments. (D)
• Ability to explain security risk clearly to technical and non-technical audiences, including senior leadership. (E)
• Strong stakeholder management, problem-solving, and collaboration skills. (E)
• Recognised security certification (e.g., CISSP, CISM, CCSP, OSCP, AWS Certified Security – Specialty). (D)

About the Role

The Information Security Lead will own BURN’s information security programme across cloud and on-premise infrastructure, business applications, and the factory and field networks that support our IoT-enabled products. They will lead remediation of known security gaps, establish identity, data protection, and third-party access controls, and build the policies, monitoring, and incident response capability BURN needs to grow securely across its markets. Reporting to the Director of Information Systems, they will coach a small security function and work closely with IT, NOC, and Engineering.

Duties and Responsibilities:

• Lead remediation of findings from external security assessments across network, web, mobile, and cloud environments, tracking closure against risk-based timelines.
• Define and deliver the information security roadmap, policies, and standards, including data classification, data loss prevention (DLP), access control, and BYOD.
• Own identity and access management, including the Microsoft Entra ID rollout, MFA, privileged access, and periodic role-based access reviews across ERP and internal business systems.
• Secure AWS and on-premise infrastructure, including IAM, network segmentation, logging, CI/CD pipelines, and infrastructure-as-code.
• Establish security monitoring, incident response, and breach management, acting as technical lead during security incidents and running an annual breach simulation.
• Partner with Legal and Compliance to meet the Kenya Data Protection Act and data protection requirements in other markets, including data retention and data subject rights.
• Govern vendor and third-party access, including security due diligence and data processing agreements for suppliers and platform partners.
• Plan and coordinate vulnerability assessments and penetration testing, and verify that fixes are effective.
• Support disaster recovery and backup testing with IT, run security awareness for staff, and coach team members developing cybersecurity skills.

Requirements (E – essential, D – desirable):

• Bachelor’s degree in computer science, engineering, or a related field. (D)
• 7+ years of experience in information or infrastructure security, including at least 2 years leading security initiatives or teams. (E)
• Strong hands-on experience securing cloud environments, particularly AWS, including IAM, networking, and logging. (E)
• Experience with identity and access management, including Microsoft Entra ID and Microsoft 365 security, MFA, and privileged access. (E)
• Proven experience running vulnerability management and penetration testing programmes, and driving remediation with engineering and IT teams. (E)
• Experience leading security incident response and building security monitoring and logging capability (SIEM or equivalent). (E)
• Working knowledge of security frameworks (e.g., ISO 27001, NIST CSF, CIS Controls) and data protection regulation, including the Kenya Data Protection Act 2019, with experience writing policies and standards. (E)
• Experience with infrastructure-as-code and securing CI/CD pipelines (e.g., Terraform, Ansible). (D)
• Experience securing manufacturing, OT, or IoT environments. (D)
• Ability to explain security risk clearly to technical and non-technical audiences, including senior leadership. (E)
• Strong stakeholder management, problem-solving, and collaboration skills. (E)
• Recognised security certification (e.g., CISSP, CISM, CCSP, OSCP, AWS Certified Security – Specialty). (D)