Officer II - Cyber Security Analyst

Job Purpose:

The Cyber Security Analyst II protects the Bank's computer systems, networks and digital channels from cyber-attacks, monitoring for security breaches, identifying vulnerabilities, and responding to security incidents under the direction of the Information Security Manager. The role carries greater operational ownership than Analyst I, including independent handling of standard incidents, hands-on administration of selected security tools, and a junior mentoring role to Analyst I staff.

Key Roles and Responsibilities:

a) Security Monitoring and Incident Responses

• Monitor the Bank's systems and networks for security breaches using Microsoft Sentinel, Darktrace, Microsoft Defender for Endpoint and Servers, and the Forti Fabric (FortiGate, FortiAnalyzer, FortiNAC, FortiAuthenticator).
• Triage, investigate and respond to security alerts and incidents independently for standard-severity cases, escalating high-severity or novel incidents to the Information Security Manager with a clear initial assessment.
• Support timely regulatory incident handling, including gathering the information required for the Bank to meet its 24-hour incident reporting obligation to the CBK Banking Sector SOC (BS-SOC) and KE-CIRT/CC under the Computer Misuse and Cybercrimes Regulations 2024.
• Conduct root cause analysis on closed incidents and contribute to lessons-learned documentation to prevent recurrence.
• Maintain audit log analysis and evidentiary records to support investigations, BFIU referrals and regulatory reporting where required.
• Support proactive threat hunting using Microsoft Sentinel, Defender XDR and Darktrace telemetry, developing towards independent hunt ownership as a growth area for the Senior Analyst role.
• Assist with monitoring and governance reviews relating to Copilot, Azure AI Foundry and emerging AI services.

b) Vulnerability and Patch Management

• Identify vulnerabilities across network, server (Windows/Linux) and application layers, and support implementation of remediation measures to prevent unauthorised access.
• Conduct and coordinate vulnerability scans, supporting the wider Tenable Nessus-based vulnerability management programme and the Bank's annual CII risk assessment obligations.
• Ensure baseline cyber security standards (SOPs) for patch and change management are met across ICT systems, working with Infrastructure to verify closure of identified gaps.

c) Security Tooling and Infrastructure

• Provide day-to-day operational support for SIEM, NDR/XDR and endpoint protection tooling, including Microsoft Sentinel, Darktrace, and Defender for Endpoint and Servers.
• Support configuration and monitoring of FortiGate firewalls, FortiSASE, FortiNAC, FortiSwitch and FortiAP within the wider Forti Fabric, under guidance from the ISM and Infrastructure teams.
• Assist with Cloudflare WAF rule monitoring and exception handling for e-banking and digital channel platforms.
• Support identity and access reviews, including periodic access recertification across Active Directory, Azure AD/Entra and privileged access (PAM) systems.
• Develop a working familiarity with Microsoft Purview data protection controls and Copilot / Azure AI Foundry usage policies, supporting governance reviews as the Bank's AI footprint grows.
• Contribute to detection rules, use cases, KQL queries and alert tuning within Microsoft Sentinel, building detection-engineering capability under the guidance of senior staff.
• Support development of automated security workflows and playbooks using Microsoft Sentinel SOAR, Logic Apps and Microsoft Security Copilot, under guidance, as a capability to grow into the Senior Analyst role.
• Monitor and investigate Azure security posture, Azure Arc connected assets and cloud security alerts.
• Support Microsoft Purview Data Loss Prevention (DLP), Information Protection and Insider Risk Management controls.

d) Testing, Evaluating and Documentation

• Test and evaluate security products and controls as part of onboarding, upgrades or remediation projects.
• Develop and maintain technical documentation, SOPs and run-books for security operations processes.
• Assist with internal and external IT/security audits and CBK examinations, including evidence gathering and tracking of findings to closure.

e) Vendor and Stakeholder Support

• Support verification of third-party vendor security posture and coordinate with vendors to meet the Bank's security requirements.
• Participate in vendor proof-of-concept evaluations for new security technologies under ISM guidance.

f) Awareness, Training and Threat Landscape

• Support delivery of security awareness training and phishing simulation campaigns (e.g. KnowBe4), including campaign analysis and reporting.
• Provide guidance and informal mentoring to Cyber Security Analyst I staff on monitoring tools, escalation procedures and investigation techniques.
• Stay current on emerging threats relevant to the Kenyan banking sector, including local fraud typologies such as SIM swap, mobile money and PesaLink-related fraud.

Academic Requirements:

• Bachelor's degree in computer science, Information Technology, Cybersecurity/Forensics or a related field from a recognised university.
• At least one internationally recognised IT security certification such as Security+, CySA+, CEH or equivalent.

Experience:

• At least two (2) years' experience in a busy IT or cybersecurity environment, with exposure to SIEM/NDR monitoring, network device configuration, Linux/Windows administration and core security fundamentals.
• Prior experience in a banking or financial services environment is an advantage.

Knowledge, Skills and Competencies:

• Practical knowledge of Windows and Linux server administration, LAN/WAN infrastructure, and firewall/routing/switching fundamentals.
• Awareness of the CBK Cyber Security Guidance Note and the Bank's obligations under the Computer Misuse and Cybercrimes Regulations 2024, including incident reporting timelines.
• Familiarity with core banking applications (e.g. Finacle / Appzillon) and their associated security considerations.
• Working knowledge of SIEM, NAC, EDR and IAM/PAM tooling and concepts, plus IPS and vulnerability testing tools.
• Good working knowledge of cloud security fundamentals (Azure) and emerging AI governance considerations.
• Strong analytical and problem-solving skills, attention to detail, and ability to document findings clearly for technical and non-technical audiences.
• High personal integrity, sound judgement and ability to handle sensitive information with appropriate confidentiality.

KPIs:

• Incident SLA compliance
• Detection rule contributions
• Threat hunting exercises completed
• Vulnerabilities remediated
• Audit findings closed
• Automation playbooks developed
• Certifications achieved

The deadline for submission is 27th October 2026.