Security Operations Center (SOC) Analyst

I start my day monitoring SIEM dashboards for threats across Kenyan financial networks. By mid-morning, I investigate a spike in M-Pesa API traffic, then coordinate with the incident response team to block a phishing campaign targeting local banks.

To become a SOC Analyst in Kenya, start with a Bachelor's degree in IT or Computer Science from institutions like JKUAT or Strathmore, and earn certifications such as CompTIA Security+, CySA+, or GCIA. Entry-level positions include Tier 1 SOC analyst roles at banks (e.g., KCB, Equity), telcos, or managed security service providers like Dimension Data Kenya. Many candidates gain experience through internships at KE-CIRT or by participating in cybersecurity bootcamps at Moringa School. Applying for graduate trainee programs at Safaricom or Airtel is also a common route.

Progression typically goes from Tier 1 Analyst to Tier 2, then Tier 3, Lead Analyst, and eventually SOC Manager or Incident Response Lead. Salaries start around KES 70,000 per month for a Tier 1 analyst, rising to KES 350,000+ after 10 years, especially with specializations in threat hunting or digital forensics. Within a decade, a SOC analyst might move from monitoring alerts to managing a team and designing security operations processes. Career advancement often requires advanced certifications like CISSP or SANS GIAC and experience with Kenya's specific threats, such as mobile money fraud.

The Kenyan market for SOC Analysts is driven by the need to protect financial transactions, especially M-Pesa, mobile banking, and e-commerce platforms like Jumia. Key employers include banks (Co-op Bank, NCBA), telecoms (Safaricom, Airtel), government entities (ICT Authority, KE-CIRT), and data centers (iColo). Jobs are concentrated in Nairobi, with some remote opportunities, but the sector is expanding due to rising cybercrime and compliance with the Data Protection Act. Growth is also fueled by Kenya's role as a regional tech hub, attracting SOC operations from East African clients.

A mid-level SOC Analyst in Nairobi starts a morning shift at 8 AM by logging into the SIEM (e.g., ArcSight) and reviewing overnight alerts. They triage a high-priority alert about a suspected ransomware infection on a bank's server, escalating to Tier 3 after initial analysis. Mid-morning, they update incident playbooks and participate in a threat intelligence brief on new phishing campaigns targeting Kenyan fintechs. In the afternoon, they investigate a series of failed login attempts and compile a daily report for the SOC manager before handing over to the night team.

Demand for SOC analysts is rising due to increased cyber threats targeting mobile money and banking apps. Nairobi-based MSSPs and banks are key employers, with roles also emerging in county governments.