The Manager, Information Security leads the development and implementation of information security strategies to protect MTN Rwanda's IT systems, telecommunications infrastructure, customer information, and digital services.

The successful candidate will oversee security risks, compliance, incident response, and cybersecurity operations while ensuring that appropriate controls are in place to protect the organization's systems and information.

Information Security Strategy and Governance

• Develop and implement information security strategies, policies, standards, and procedures.
• Conduct security risk assessments and maintain the organization's risk register.
• Ensure security practices align with relevant standards, including ISO/IEC 27001, NIST, PCI DSS, and GSMA security guidelines.
• Monitor compliance with applicable data protection, privacy, and cybersecurity requirements.
• Coordinate security audits and follow up on corrective actions.
• Prepare security reports and communicate significant risks to senior management.

Network and Telecommunications Security

• Oversee security controls for telecommunications networks and IT infrastructure.
• Monitor the effectiveness of firewalls, intrusion prevention systems, DDoS protection, and secure gateways.
• Work with network teams to strengthen the security of routers, switches, and other network devices.
• Review privileged access and third-party access to critical systems.
• Assess the security of new technologies, cloud platforms, IoT services, and Mobile Money solutions.
• Support the protection of customer information and critical business data.

Security Operations and Incident Response

• Oversee security monitoring, threat detection, and incident response activities.
• Coordinate investigations and responses to major cybersecurity incidents.
• Conduct root-cause analysis and ensure corrective measures are implemented.
• Manage vulnerability assessments and penetration testing programmes.
• Monitor the resolution of security weaknesses.
• Organize incident-response exercises to improve preparedness.

Security Technology and Third-Party Risk

• Evaluate security technologies such as SIEM platforms, threat intelligence solutions, and network security tools.
• Manage relationships with cybersecurity service providers and technology vendors.
• Assess security risks associated with suppliers, partners, and service providers.
• Support security budgeting and resource allocation.
• Ensure appropriate security requirements are included in relevant contracts and service arrangements.

Staff Awareness and Compliance

• Develop information security awareness and training programmes.
• Conduct phishing simulations and other security awareness activities.
• Promote secure working practices across departments.
• Collaborate with relevant teams on data protection and regulatory compliance.
• Coordinate with regulators and other authorities when required.

Qualifications and Requirements

• Bachelor's degree in Information Security, Computer Science, Telecommunications Engineering, or a related field. A Master's degree is preferred.
• At least 7 years of experience in information security or network security.
• At least 4 years of supervisory or managerial experience in telecommunications, IT security, or IT security auditing.
• Strong knowledge of TCP/IP networking and network security architecture.
• Experience in security operations, incident response, and vulnerability management.
• Knowledge of security audits and compliance frameworks, particularly ISO/IEC 27001 and PCI DSS.
• Experience addressing regulatory and compliance requirements.
• Strong leadership, analytical, communication, and risk management skills.
• Professional Certifications: At least one recognized certification is required, such as CISSP, CISM, CISA, CCNP Security, CEH, or an equivalent professional certification. ISO/IEC 27001 Lead Implementer or Lead Auditor certification is an added advantage.
• Experience in telecommunications, Mobile Money, or financial services security is beneficial.

• Develop and implement information security strategies, policies, standards, and procedures.
• Conduct security risk assessments and maintain the organization's risk register.
• Ensure security practices align with relevant standards, including ISO/IEC 27001, NIST, PCI DSS, and GSMA security guidelines.
• Monitor compliance with applicable data protection, privacy, and cybersecurity requirements.
• Coordinate security audits and follow up on corrective actions.
• Prepare security reports and communicate significant risks to senior management.
• Oversee security controls for telecommunications networks and IT infrastructure.
• Monitor the effectiveness of firewalls, intrusion prevention systems, DDoS protection, and secure gateways.
• Work with network teams to strengthen the security of routers, switches, and other network devices.
• Review privileged access and third-party access to critical systems.
• Assess the security of new technologies, cloud platforms, IoT services, and Mobile Money solutions.
• Support the protection of customer information and critical business data.
• Oversee security monitoring, threat detection, and incident response activities.
• Coordinate investigations and responses to major cybersecurity incidents.
• Conduct root-cause analysis and ensure corrective measures are implemented.
• Manage vulnerability assessments and penetration testing programmes.
• Monitor the resolution of security weaknesses.
• Organize incident-response exercises to improve preparedness.
• Evaluate security technologies such as SIEM platforms, threat intelligence solutions, and network security tools.
• Manage relationships with cybersecurity service providers and technology vendors.
• Assess security risks associated with suppliers, partners, and service providers.
• Support security budgeting and resource allocation.
• Ensure appropriate security requirements are included in relevant contracts and service arrangements.
• Develop information security awareness and training programmes.
• Conduct phishing simulations and other security awareness activities.
• Promote secure working practices across departments.
• Collaborate with relevant teams on data protection and regulatory compliance.
• Coordinate with regulators and other authorities when required.

• Information security strategy
• Risk assessment
• ISO/IEC 27001
• NIST
• PCI DSS
• GSMA security guidelines
• Data protection
• Privacy
• Cybersecurity
• Security audits
• Network security
• Telecommunications security
• Firewalls
• Intrusion prevention systems
• DDoS protection
• Secure gateways
• Network devices security
• Privileged access management
• Third-party access management
• Cloud security
• IoT security
• Mobile Money security
• Customer information protection
• Business data protection
• Security monitoring
• Threat detection
• Incident response
• Cybersecurity incident investigation
• Root-cause analysis
• Vulnerability management
• Penetration testing
• Security technology evaluation
• SIEM platforms
• Threat intelligence solutions
• Network security tools
• Vendor management
• Supplier risk assessment
• Partner risk assessment
• Service provider risk assessment
• Security budgeting
• Resource allocation
• Contract security requirements
• Information security awareness training
• Phishing simulations
• Secure working practices
• Regulatory compliance
• TCP/IP networking
• Network security architecture
• Leadership
• Analytical skills
• Communication skills
• Risk management skills

• Bachelor's degree in Information Security, Computer Science, Telecommunications Engineering, or a related field.
• Master's degree is preferred.
• At least 7 years of experience in information security or network security.
• At least 4 years of supervisory or managerial experience in telecommunications, IT security, or IT security auditing.
• Strong knowledge of TCP/IP networking and network security architecture.
• Experience in security operations, incident response, and vulnerability management.
• Knowledge of security audits and compliance frameworks, particularly ISO/IEC 27001 and PCI DSS.
• Experience addressing regulatory and compliance requirements.
• Strong leadership, analytical, communication, and risk management skills.
• At least one recognized certification is required, such as CISSP, CISM, CISA, CCNP Security, CEH, or an equivalent professional certification.
• ISO/IEC 27001 Lead Implementer or Lead Auditor certification is an added advantage.
• Experience in telecommunications, Mobile Money, or financial services security is beneficial.