Are you a seasoned cybersecurity professional looking to take your career to the next level in a dynamic and forward-thinking organization? AAR Insurance invites you to apply for the position of Information Security Officer (ISO). This is your opportunity to be part of a trusted insurance provider that has built a reputation for excellence in service delivery across East Africa.
As a cornerstone of the organization’s digital infrastructure, the Information Security Officer will play a crucial role in fortifying the organization’s cybersecurity posture, ensuring compliance with industry regulations, and safeguarding critical digital assets.
This full-time position is based at the AAR Insurance Head Office in Nairobi, Kenya, and the deadline for application is 30th April 2025.
About AAR Insurance
AAR Insurance is a market leader in medical insurance and has expanded its offerings to general insurance products in Kenya and the broader East African region. With a strong digital transformation agenda, AAR is investing in cutting-edge technology to improve customer experience, operational efficiency, and service delivery.
At AAR, we value diversity, innovation, and professionalism. We are an equal-opportunity employer and welcome candidates from all backgrounds to apply.
Position: Information Security Officer
Location: Head Office, Nairobi, Kenya
Job Type: Full Time
Deadline: 30th April 2025
Overall Purpose of the Job
Reporting directly to the Group Head of Technology, the Information Security Officer (ISO) will spearhead the development and execution of the enterprise-wide information security strategy. This includes overseeing security for both cloud and on-premise environments while ensuring robust cyber defenses, regulatory compliance, and enterprise risk management.
The ISO will act as the focal point for all cybersecurity-related engagements and must demonstrate expertise in managing enterprise security functions, ideally within the insurance or broader financial services sector.
Key Responsibilities
- Information Security Strategy & Governance
- Develop, implement, and continuously improve the organization’s comprehensive information security strategy.
- Align security goals with broader business objectives and regulatory requirements.
- Formulate and update security policies, procedures, and controls to ensure business-wide adherence.
- Cybersecurity Management
- Lead the organization’s cybersecurity initiatives to protect against threats and vulnerabilities.
- Ensure proper enforcement of security protocols and governance in all business units.
- Define and manage security controls for hybrid infrastructures (cloud and on-premise).
- Compliance and Risk Management
- Ensure organization-wide compliance with data protection laws such as HIPAA, GDPR, and local insurance regulations.
- Establish and manage risk assessment frameworks to identify and mitigate security threats.
- Manage third-party risks by evaluating vendor security postures.
- Security Operations & Incident Response
- Monitor and address security incidents, ensuring swift response and resolution.
- Conduct internal security audits and manage external security assessments.
- Lead post-incident analysis to improve future incident response and business continuity.
- Cloud and On-Premise Security Oversight
- Oversee security practices across cloud platforms like AWS and Azure.
- Implement modern IAM (Identity and Access Management), encryption techniques, and endpoint protection protocols.
- Maintain a secure DevSecOps environment in collaboration with IT and DevOps teams.
- Training and Awareness
- Design and implement employee security awareness programs to build a security-conscious workforce.
- Promote security best practices across departments and teams.
- Innovation and Threat Intelligence
- Stay abreast of evolving cybersecurity threats and trends.
- Research and implement advanced security tools and technologies, including zero-trust models and AI-powered security analytics.
- Drive red team/blue team exercises, penetration testing, and continuous security improvements.
- Leadership and Collaboration
- Provide expert guidance to executive leadership and stakeholders on security-related decisions.
- Lead due diligence efforts in technology-related mergers and acquisitions.
- Collaborate with legal, compliance, and IT teams to maintain regulatory alignment.
Education, Experience & Competencies
Note: Academic and certification requirements have been provided by the hiring organization.
- Bachelor’s or Master’s degree in Cybersecurity, Information Technology, Computer Science, or a related discipline.
- Relevant professional certifications such as CISSP, CISM, CISA, CRISC, CCSP, or CEH are highly desirable.
- A minimum of 5 years of experience in information security, preferably in the financial, insurance, or healthcare sectors.
- Demonstrated experience in managing cybersecurity for both cloud-based and on-premise environments.
- Strong understanding of compliance standards such as HIPAA, GDPR, ISO 27001, and PCI DSS.
- Proven track record in leading security operations, conducting risk assessments, and handling incident response in a complex IT ecosystem.
- Excellent leadership, communication, and stakeholder engagement skills.
- Strong knowledge of cloud security, DevSecOps, firewall and endpoint security, SIEM, and IAM.
- High standards of integrity, confidentiality, and strategic thinking in cybersecurity.
Why Join AAR Insurance?
- Impactful Role: Play a key role in shaping the digital security landscape of a leading insurance company.
- Career Growth: Opportunities for continuous professional development and leadership in cybersecurity.
- Inclusive Culture: Work in an environment that fosters innovation, teamwork, and inclusion.
- Modern Workplace: Be part of a tech-driven organization prioritizing cutting-edge solutions and transformation.
How to Apply
If you meet the qualifications and are excited to be part of a progressive and secure work environment, we welcome your application.
To apply, please send your application letter, updated CV, and any relevant testimonials to the email address provided in the job description.
Email: [email protected]
Application Deadline: 30th April 2025Apply Now
