From the employer's hiring system · Verified employer
Information Security Lead
BURN Manufacturing
Job at a glance
- Employer
- BURN Manufacturing
- Position
- Information Security Lead
- Location
- Nairobi, Kenya
- Job type
- Full-time
- Experience
- 7+ years in infosec, 2+ years leading
- Education
- Bachelor's degree (Desirable)
- Salary
- Not stated in the advert
- Application deadline
- 13 January 2027
- Posted on VacancyKE
- 15 October 2026
VacancyKE summary
BURN Manufacturing is hiring an Information Security Lead in Nairobi to own their security programme across cloud, on-premise, and IoT networks. You will lead remediation efforts, establish identity and data protection controls, and build incident response capabilities while coaching a small security team.
What stands out about this opportunity
- Focuses on securing IoT-enabled products and factory networks.
- Involves owning the full security roadmap and policy creation.
- Requires close partnership with Legal and Compliance teams.
- Includes coaching a small security function.
Key responsibilities
- Lead remediation of external security assessment findings across network, web, mobile, and cloud environments.
- Define and deliver the information security roadmap, policies, and standards including DLP and BYOD.
- Own identity and access management, covering Microsoft Entra ID rollout, MFA, and privileged access reviews.
- Secure AWS and on-premise infrastructure, focusing on IAM, network segmentation, logging, and CI/CD pipelines.
- Establish security monitoring and incident response, acting as technical lead during breaches and running annual simulations.
- Partner with Legal to ensure compliance with the Kenya Data Protection Act and other market regulations.
- Govern vendor and third-party access through security due diligence and data processing agreements.
- Plan vulnerability assessments and penetration testing, verifying that fixes are effective.
Who should apply?
This role suits a senior security professional with strong AWS and Azure AD expertise who has led security teams and understands regulatory compliance in Kenya.
Key requirements
- 7+ years information security experience
- 2+ years leading security initiatives
- Hands-on AWS security experience
- Microsoft Entra ID and MFA proficiency
- Incident response leadership
- Kenya Data Protection Act knowledge
Nice to have
- Bachelor’s degree in computer science, engineering, or a related field.
- Experience with infrastructure-as-code and securing CI/CD pipelines (e.g., Terraform, Ansible).
- Experience securing manufacturing, OT, or IoT environments.
- Recognised security certification (e.g., CISSP, CISM, CCSP, OSCP, AWS Certified Security).
What you should know
- Reports to the Director of Information Systems.
- Works closely with IT, NOC, and Engineering departments.
- Coaches team members developing cybersecurity skills.
- Supports disaster recovery and backup testing with IT.
- Runs security awareness training for staff.
- Qualified female candidates are encouraged to apply.
- BURN does not charge any fees at any stage of recruitment.
How to apply
- Apply via the BURN Manufacturing careers portal using the provided link.
Official source: From the employer's hiring system · burnmanufacturing.applytojob.com. VacancyKE never charges job seekers.
Original employer advertisement
Published by BURN Manufacturing on burnmanufacturing.applytojob.com. Shown for reference; the employer’s version is the official one.
The employer’s advert
About the Role
The Information Security Lead will own BURN’s information security programme across cloud and on-premise infrastructure, business applications, and the factory and field networks that support our IoT-enabled products. They will lead remediation of known security gaps, establish identity, data protection, and third-party access controls, and build the policies, monitoring, and incident response capability BURN needs to grow securely across its markets. Reporting to the Director of Information Systems, they will coach a small security function and work closely with IT, NOC, and Engineering.
Duties and Responsibilities:
• Lead remediation of findings from external security assessments across network, web, mobile, and cloud environments, tracking closure against risk-based timelines.
• Define and deliver the information security roadmap, policies, and standards, including data classification, data loss prevention (DLP), access control, and BYOD.
• Own identity and access management, including the Microsoft Entra ID rollout, MFA, privileged access, and periodic role-based access reviews across ERP and internal business systems.
• Secure AWS and on-premise infrastructure, including IAM, network segmentation, logging, CI/CD pipelines, and infrastructure-as-code.
• Establish security monitoring, incident response, and breach management, acting as technical lead during security incidents and running an annual breach simulation.
• Partner with Legal and Compliance to meet the Kenya Data Protection Act and data protection requirements in other markets, including data retention and data subject rights.
• Govern vendor and third-party access, including security due diligence and data processing agreements for suppliers and platform partners.
• Plan and coordinate vulnerability assessments and penetration testing, and verify that fixes are effective.
• Support disaster recovery and backup testing with IT, run security awareness for staff, and coach team members developing cybersecurity skills.
Requirements (E – essential, D – desirable):
• Bachelor’s degree in computer science, engineering, or a related field. (D)
• 7+ years of experience in information or infrastructure security, including at least 2 years leading security initiatives or teams. (E)
• Strong hands-on experience securing cloud environments, particularly AWS, including IAM, networking, and logging. (E)
• Experience with identity and access management, including Microsoft Entra ID and Microsoft 365 security, MFA, and privileged access. (E)
• Proven experience running vulnerability management and penetration testing programmes, and driving remediation with engineering and IT teams. (E)
• Experience leading security incident response and building security monitoring and logging capability (SIEM or equivalent). (E)
• Working knowledge of security frameworks (e.g., ISO 27001, NIST CSF, CIS Controls) and data protection regulation, including the Kenya Data Protection Act 2019, with experience writing policies and standards. (E)
• Experience with infrastructure-as-code and securing CI/CD pipelines (e.g., Terraform, Ansible). (D)
• Experience securing manufacturing, OT, or IoT environments. (D)
• Ability to explain security risk clearly to technical and non-technical audiences, including senior leadership. (E)
• Strong stakeholder management, problem-solving, and collaboration skills. (E)
• Recognised security certification (e.g., CISSP, CISM, CCSP, OSCP, AWS Certified Security – Specialty). (D)
Qualified Female Candidates encouraged to apply
BURN does not charge a fee at any stage of the recruitment process (application, interview, meeting, processing, training, or any other fees).
The Information Security Lead will own BURN’s information security programme across cloud and on-premise infrastructure, business applications, and the factory and field networks that support our IoT-enabled products. They will lead remediation of known security gaps, establish identity, data protection, and third-party access controls, and build the policies, monitoring, and incident response capability BURN needs to grow securely across its markets. Reporting to the Director of Information Systems, they will coach a small security function and work closely with IT, NOC, and Engineering.
Duties and Responsibilities:
• Lead remediation of findings from external security assessments across network, web, mobile, and cloud environments, tracking closure against risk-based timelines.
• Define and deliver the information security roadmap, policies, and standards, including data classification, data loss prevention (DLP), access control, and BYOD.
• Own identity and access management, including the Microsoft Entra ID rollout, MFA, privileged access, and periodic role-based access reviews across ERP and internal business systems.
• Secure AWS and on-premise infrastructure, including IAM, network segmentation, logging, CI/CD pipelines, and infrastructure-as-code.
• Establish security monitoring, incident response, and breach management, acting as technical lead during security incidents and running an annual breach simulation.
• Partner with Legal and Compliance to meet the Kenya Data Protection Act and data protection requirements in other markets, including data retention and data subject rights.
• Govern vendor and third-party access, including security due diligence and data processing agreements for suppliers and platform partners.
• Plan and coordinate vulnerability assessments and penetration testing, and verify that fixes are effective.
• Support disaster recovery and backup testing with IT, run security awareness for staff, and coach team members developing cybersecurity skills.
Requirements (E – essential, D – desirable):
• Bachelor’s degree in computer science, engineering, or a related field. (D)
• 7+ years of experience in information or infrastructure security, including at least 2 years leading security initiatives or teams. (E)
• Strong hands-on experience securing cloud environments, particularly AWS, including IAM, networking, and logging. (E)
• Experience with identity and access management, including Microsoft Entra ID and Microsoft 365 security, MFA, and privileged access. (E)
• Proven experience running vulnerability management and penetration testing programmes, and driving remediation with engineering and IT teams. (E)
• Experience leading security incident response and building security monitoring and logging capability (SIEM or equivalent). (E)
• Working knowledge of security frameworks (e.g., ISO 27001, NIST CSF, CIS Controls) and data protection regulation, including the Kenya Data Protection Act 2019, with experience writing policies and standards. (E)
• Experience with infrastructure-as-code and securing CI/CD pipelines (e.g., Terraform, Ansible). (D)
• Experience securing manufacturing, OT, or IoT environments. (D)
• Ability to explain security risk clearly to technical and non-technical audiences, including senior leadership. (E)
• Strong stakeholder management, problem-solving, and collaboration skills. (E)
• Recognised security certification (e.g., CISSP, CISM, CCSP, OSCP, AWS Certified Security – Specialty). (D)
Qualified Female Candidates encouraged to apply
BURN does not charge a fee at any stage of the recruitment process (application, interview, meeting, processing, training, or any other fees).