Principal Information Systems Auditor - Information Security at Safaricom Kenya

Key Responsibilities:

• Participation in the overall development and delivery of the audit plan
• Plan, execute and document security related audits within the IT and telecoms network environments and recommend improvement opportunities to remediate identified vulnerabilities.
• Ensure audit objectives, audit procedures and test results are documented in a manner consistent with the Safaricom Internal Audit methodology.
• Discuss audit findings with key stakeholders and prepare audit reports that include thematic issues and trends identified through the execution of IT/Cybersecurity audits
• Conduct IT audits to provide assurance on the adequacy of controls to mitigate and/or manage the technology risk to acceptable levels
• Track remediation of issues arising from audits and work with stakeholders to avoid overdue audit actions
• Serve as an on-going subject matter expert in the area of information security controls and technologies
• Build trusted relationships within the Technology security community and act as a business partner
• Delivery of continuous information security assessments and penetration testing.
• Review security control frameworks/guidelines to ensure consistent application of security controls
• Review procedures for investigating and closure of technology security incidents in line with industry best practices
• Keep abreast with the latest technology security trends and provide input to mitigate emerging threats

 
QUALIFICATIONS

• Degree in Computer Science, IT, Business Information Systems (or related technical / business field) from a recognized university.
• 5-7 years working experience in information systems audit and cyber security assurance
• Holder of an IT/cyber certification such as Certified Ethical Hacker (CEH), CISSP, CISM or other information security certification and experience working with information security frameworks such as ISO27001, NIST 800-171, Cyber Essentials / DCPP.
• Experience in performing application and infrastructure penetration tests, as well as physical security reviews and social engineering tests
• Strong working knowledge of security principles, techniques and technologies with a good understanding of network protocols, design and operations
• Knowledge of common IT and networking technologies (operating systems, relational databases, network/mobile technologies) including Oracle or MS SQL databases, Unix / Linux / Windows etc.
• Certified Information Systems Auditor (CISA) or equivalent would be an advantage
• Ability to evaluate risks, articulate issues, develop consensus, raise awareness and recommend practical solutions
• Strong relationship, communication and stakeholder management skills
• Ability to initiate and build effective stakeholder relationships
• The ability to work under pressure and be resilient and tenacious to get results