<div> About the Role  The Information Security Lead will own BURN’s information security programme across cloud and on-premise infrastructure, business applications, and the factory and field networks that support our IoT-enabled products. They will lead remediation of known security gaps, establish identity, data protection, and third-party access controls, and build the policies, monitoring, and incident response capability BURN needs to grow securely across its markets. Reporting to the Director of Information Systems, they will coach a small security function and work closely with IT, NOC, and Engineering. Duties and Responsibilities:<ul><li style="margin-left:8px;">Lead remediation of findings from external security assessments across network, web, mobile, and cloud environments, tracking closure against risk-based timelines.</li><li style="margin-left:8px;">Define and deliver the information security roadmap, policies, and standards, including data classification, data loss prevention (DLP), access control, and BYOD.</li><li style="margin-left:8px;">Own identity and access management, including the Microsoft Entra ID rollout, MFA, privileged access, and periodic role-based access reviews across ERP and internal business systems.</li><li style="margin-left:8px;">Secure AWS and on-premise infrastructure, including IAM, network segmentation, logging, CI/CD pipelines, and infrastructure-as-code.</li><li style="margin-left:8px;">Establish security monitoring, incident response, and breach management, acting as technical lead during security incidents and running an annual breach simulation.</li><li style="margin-left:8px;">Partner with Legal and Compliance to meet the Kenya Data Protection Act and data protection requirements in other markets, including data retention and data subject rights.</li><li style="margin-left:8px;">Govern vendor and third-party access, including security due diligence and data processing agreements for suppliers and platform partners.</li><li style="margin-left:8px;">Plan and coordinate vulnerability assessments and penetration testing, and verify that fixes are effective.</li><li style="margin-left:8px;">Support disaster recovery and backup testing with IT, run security awareness for staff, and coach team members developing cybersecurity skills.</li></ul> Skills and Requirements <ul><li>Bachelor’s degree in computer science, engineering, or a related field.</li><li>7+ years of experience in information or infrastructure security, including at least 2 years leading security initiatives or teams.</li><li>Strong hands-on experience securing cloud environments, particularly AWS, including IAM, networking, and logging. </li><li>Experience with identity and access management, including Microsoft Entra ID and Microsoft 365 security, MFA, and privileged access. </li><li>Proven experience running vulnerability management and penetration testing programmes, and driving remediation with engineering and IT teams. </li><li>Experience leading security incident response and building security monitoring and logging capability (SIEM or equivalent). </li><li>Working knowledge of security frameworks (e.g., ISO 27001, NIST CSF, CIS Controls) and data protection regulation, including the Kenya Data Protection Act 2019, with experience writing policies and standards.</li><li>Experience with infrastructure-as-code and securing CI/CD pipelines (e.g., Terraform, Ansible). </li><li>Experience securing manufacturing, OT, or IoT environments. </li><li>Ability to explain security risk clearly to technical and non-technical audiences, including senior leadership. </li><li>Strong stakeholder management, problem-solving, and collaboration skills. </li><li>Recognised security certification (e.g., CISSP, CISM, CCSP, OSCP, AWS Certified Security – Specialty). </li></ul><div style="text-align:center;">Qualified Female Candidates encouraged to apply BURN does not charge a fee at any stage of the recruitment process (application, interview, meeting, processing, training, or any other fees).</div> </div>

BURN is working to create a world where cooking positively impacts all life on earth by producing the world&rsquo;s most efficient biomass, liquid fuel, and electric cookstoves. BURN is the largest vertically integrated modern cookstove company in the world, providing world-class R&amp;D, manufacturing, and carbon offset projects from our HQ in Kenya and across 10 countries in Africa. Our team &ndash; half of whom are women &ndash; produces and sells over 200,000 stoves per month at our solar-powered facility in Kenya. The company was founded by CEO Peter Scott, who is recognised as the global leader in cookstove commercialisation. BURN has received recognition for its cutting-edge innovation and environmental &amp; social impact from, among others Bloomberg New Energy Finance Award, Global Leap Awards, and Ashden International. BURN is an equal-opportunity employer that is committed to creating the best workplace in the world. Visit BURN/careers if you would like to be part of a world-class team that is committed to making positive, measurable change for people, forests, and the climate.

Information Security Lead

<div> About the Role  The Information Security Lead will own BURN’s information security programme across cloud and on-premise infrastructure, business applications, and the factory and field networks that support our IoT-enabled products. They will lead remediation of known security gaps, establish identity, data protection, and third-party access controls, and build the policies, monitoring, and incident response capability BURN needs to grow securely across its markets. Reporting to the Director of Information Systems, they will coach a small security function and work closely with IT, NOC, and Engineering. Duties and Responsibilities:<ul><li>Lead remediation of findings from external security assessments across network, web, mobile, and cloud environments, tracking closure against risk-based timelines.</li><li>Define and deliver the information security roadmap, policies, and standards, including data classification, data loss prevention (DLP), access control, and BYOD.</li><li>Own identity and access management, including the Microsoft Entra ID rollout, MFA, privileged access, and periodic role-based access reviews across ERP and internal business systems.</li><li>Secure AWS and on-premise infrastructure, including IAM, network segmentation, logging, CI/CD pipelines, and infrastructure-as-code.</li><li>Establish security monitoring, incident response, and breach management, acting as technical lead during security incidents and running an annual breach simulation.</li><li>Partner with Legal and Compliance to meet the Kenya Data Protection Act and data protection requirements in other markets, including data retention and data subject rights.</li><li>Govern vendor and third-party access, including security due diligence and data processing agreements for suppliers and platform partners.</li><li>Plan and coordinate vulnerability assessments and penetration testing, and verify that fixes are effective.</li><li>Support disaster recovery and backup testing with IT, run security awareness for staff, and coach team members developing cybersecurity skills.</li></ul> Skills and Requirements <ul><li>Bachelor’s degree in computer science, engineering, or a related field.</li><li>7+ years of experience in information or infrastructure security, including at least 2 years leading security initiatives or teams.</li><li>Strong hands-on experience securing cloud environments, particularly AWS, including IAM, networking, and logging. </li><li>Experience with identity and access management, including Microsoft Entra ID and Microsoft 365 security, MFA, and privileged access. </li><li>Proven experience running vulnerability management and penetration testing programmes, and driving remediation with engineering and IT teams. </li><li>Experience leading security incident response and building security monitoring and logging capability (SIEM or equivalent). </li><li>Working knowledge of security frameworks (e.g., ISO 27001, NIST CSF, CIS Controls) and data protection regulation, including the Kenya Data Protection Act 2019, with experience writing policies and standards.</li><li>Experience with infrastructure-as-code and securing CI/CD pipelines (e.g., Terraform, Ansible). </li><li>Experience securing manufacturing, OT, or IoT environments. </li><li>Ability to explain security risk clearly to technical and non-technical audiences, including senior leadership. </li><li>Strong stakeholder management, problem-solving, and collaboration skills. </li><li>Recognised security certification (e.g., CISSP, CISM, CCSP, OSCP, AWS Certified Security – Specialty). </li></ul><div>Qualified Female Candidates encouraged to apply BURN does not charge a fee at any stage of the recruitment process (application, interview, meeting, processing, training, or any other fees).</div> </div>

Information Security Lead

About the Job

About the Company

BURN

Similar Jobs

Cyber Security Analyst

Cyber Security Analyst

Sr. Product Security Engineer

Sr. Product Security Engineer

Lead Architect - Network Security

Lead Architect - Network Security

Information Security Officer (ISO) Asia-Pacific

Information Security Officer (ISO) Asia-Pacific

Security Coordinator

Security Coordinator

Lead Application Security Engineer

Lead Application Security Engineer

Senior Security Engineer

Senior Security Engineer

Senior IT Risk Officer

Senior IT Risk Officer

Lead Cyber Detect & Response Specialist

Lead Cyber Detect & Response Specialist

Senior Cybersecurity Engineer

Senior Cybersecurity Engineer