Technology

Master of Science in Information Technology Security and Audit

The Master of Science in Information Technology Security and Audit is a postgraduate programme that trains graduates in IT security, IT audit, cybersecurity governance, and risk assurance. The programme prepares graduates for advanced careers in IT security management, IT auditing, cybersecurity compliance, and risk management.

Core areas include IT security, IT audit, cybersecurity governance, risk management, compliance, penetration testing, digital forensics, security operations, secure systems design, and research methods. Students engage with both technical and managerial aspects of IT security and audit.

The programme is offered by Kabarak University through its School of Science, Engineering and Technology, with Jaramogi Oginga Odinga University of Science and Technology as a college. Kabarak is a private university in Nakuru. The programme is available both on-campus and fully online.

Students develop competencies in IT security, IT audit, risk assessment, compliance, security governance, penetration testing, and digital forensics. The programme includes coursework, practical assessments, examinations, supervised research, and thesis.

The programme is delivered over two years. On-campus tuition is KES 80,000 per semester (~KES 160,000/year). Online tuition is KES 53,700 per semester (~KES 107,400/year). Kabarak requires Bachelor's in CS/IT with Second Class Upper or Lower with PGDip or research experience.

Graduates pursue careers as IT security managers, IT auditors, cybersecurity analysts, compliance officers, risk managers, and lecturers in banks, audit firms, government, consulting firms, and universities.

Skills Required

IT Security and Cybersecurity Management
IT Audit and Assurance
Cybersecurity Governance and Compliance
Risk Management and Risk Assessment
Penetration Testing and Vulnerability Assessment
Digital Forensics and Incident Response
Security Operations and Monitoring
Secure Systems Design and Architecture
IT Controls and Control Frameworks
IT Security and Audit Research Methods

Key Subjects

IT Security
IT Audit and Assurance
Cybersecurity Governance
Risk Management and Compliance
Penetration Testing
Digital Forensics
Security Operations
Secure Systems Design
IT Controls and Frameworks
IT Security Research Methods

Certifications

ISACA CISA Certification
ISC2 CISSP Certification

Specializations

IT Audit and Assurance

Focuses on IT audit, audit planning, audit execution, audit reporting, IT controls, COBIT, and conducting and managing IT audits in organisations.

Cybersecurity Governance

Examines cybersecurity governance, security policies, security standards, ISO 27001, NIST, compliance, and governing and managing cybersecurity in organisations.

Risk Management and Compliance

Covers risk management, risk assessment, risk treatment, compliance management, regulatory compliance, and managing and ensuring IT risk and compliance.

Penetration Testing

Focuses on penetration testing, vulnerability assessment, ethical hacking, security testing, and identifying and addressing security vulnerabilities.

Digital Forensics

Examines digital forensics, forensic investigation, evidence handling, forensic tools, and conducting digital forensic investigations.

Security Operations

Covers security operations, security monitoring, SIEM, incident response, threat management, and managing and operating security operations centres.

Duration: 2 years
Public, up to: Ksh 266,000
Private, up to: Ksh 160,000
Job market: Very high

The programme

What you study, how long it takes, and how it is delivered.

Practicalities

Study mode: Full-time, Part-time, Online
Attachment: 0 months
Average class: 20 students
Award: Masters

What you study

10 subjects

IT Security
IT Audit and Assurance
Cybersecurity Governance
Risk Management and Compliance
Penetration Testing
Digital Forensics
Security Operations
Secure Systems Design
IT Controls and Frameworks
IT Security Research Methods

Modules

12 in the programme

IT Security Foundations
Year 1Semester 13 creditsCore
Examines IT security principles, security frameworks, security architecture, threat management, security models, and understanding and managing IT security.
IT Audit and Assurance
Year 1Semester 13 creditsCore
Covers IT audit, audit planning, audit execution, audit evidence, audit reporting, IT controls, COBIT, and conducting and managing IT audits in organisations.
Cybersecurity Governance and Compliance
Year 1Semester 13 creditsCore
Examines cybersecurity governance, security policies, ISO 27001, NIST, security standards, compliance management, and governing and managing cybersecurity.
Risk Management and Assessment
Year 1Semester 23 creditsCore
Covers risk management, risk assessment, risk analysis, risk treatment, risk monitoring, ISO 27005, and managing IT risks in organisations.
Penetration Testing and Vulnerability Assessment
Year 1Semester 23 creditsCore
Examines penetration testing, ethical hacking, vulnerability assessment, exploitation, security testing tools, and identifying and addressing security vulnerabilities.
Digital Forensics and Incident Response
Year 1Semester 23 creditsCore
Covers digital forensics, forensic investigation, evidence handling, forensic tools, incident response, and conducting digital forensic investigations.
Security Operations and Monitoring
Year 2Semester 13 creditsCore
Examines security operations, security monitoring, SIEM, incident response, threat intelligence, security operations centres, and managing security operations.
Secure Systems Design and Architecture
Year 2Semester 13 creditsCore
Covers secure architecture, secure design principles, security by design, threat modelling, secure coding, and designing secure IT systems.
IT Controls and Control Frameworks
Year 2Semester 13 creditsCore
Examines IT general controls, application controls, control testing, control evaluation, COBIT, COSO, and understanding and evaluating IT controls.
IT Security and Audit Research Methods
Year 2Semester 13 creditsCore
Covers research methods for IT security and audit, experimental design, security evaluation, audit research, data analysis, and conducting IT security research, preparing students for their thesis.
Cloud Security and Emerging Technologies
Year 2Semester 23 creditsCore
Examines cloud security, cloud security architecture, container security, IoT security, AI in security, blockchain security, and securing emerging technologies.
Research Thesis
Year 2Semester 26 creditsCore
Original research thesis on an IT security and audit topic, demonstrating mastery of research methods and IT security knowledge, assessed through written submission and oral defence.

Specialisations

IT Audit and Assurance
Focuses on IT audit, audit planning, audit execution, audit reporting, IT controls, COBIT, and conducting and managing IT audits in organisations.
Cybersecurity Governance
Examines cybersecurity governance, security policies, security standards, ISO 27001, NIST, compliance, and governing and managing cybersecurity in organisations.
Risk Management and Compliance
Covers risk management, risk assessment, risk treatment, compliance management, regulatory compliance, and managing and ensuring IT risk and compliance.
Penetration Testing
Focuses on penetration testing, vulnerability assessment, ethical hacking, security testing, and identifying and addressing security vulnerabilities.
Digital Forensics
Examines digital forensics, forensic investigation, evidence handling, forensic tools, and conducting digital forensic investigations.
Security Operations
Covers security operations, security monitoring, SIEM, incident response, threat management, and managing and operating security operations centres.

A day as a student

A typical day during the MSc IT Security and Audit programme at Kabarak University begins with morning lectures at the Nakuru campus or online sessions for distance learners. Students engage in theoretical discussions on IT security, audit principles, and risk management. IT security sessions cover security principles, security frameworks, security architecture, threat management, and understanding and managing IT security. IT audit sessions examine audit planning, audit execution, audit evidence, audit reporting, IT controls, COBIT, and conducting and managing IT audits. Cybersecurity governance sessions cover security governance, security policies, ISO 27001, NIST, security standards, compliance, and governing cybersecurity. Risk management sessions examine risk assessment, risk analysis, risk treatment, risk monitoring, ISO 27005, and managing IT risks. Compliance sessions cover regulatory compliance, data protection compliance, audit compliance, compliance frameworks, and ensuring IT compliance. Penetration testing sessions examine ethical hacking, vulnerability assessment, exploitation, security testing tools, and identifying and addressing vulnerabilities. Digital forensics sessions cover forensic investigation, evidence handling, forensic tools, disk forensics, network forensics, and conducting forensic investigations. Security operations sessions examine security monitoring, SIEM, incident response, threat intelligence, security operations centres, and managing security operations. Secure systems design sessions cover secure architecture, secure design principles, security by design, threat modelling, and designing secure IT systems. IT controls sessions examine IT general controls, application controls, control testing, control evaluation, and understanding and evaluating IT controls. Practical sessions provide hands-on experience with security tools, audit tools, forensic tools, and penetration testing tools. Research methodology sessions prepare students for their thesis, covering IT security and audit research methods, experimental design, and data analysis. Guest lectures from ISACA professionals, KE-CIRT analysts, ODPC officials, IT audit practitioners, and cybersecurity industry leaders provide real-world insights. The two-year programme culminates in a research thesis.

The trade offs

In its favour

Kabarak offers on-campus and fully online options, providing flexibility for both full-time students and working professionals.
On-campus tuition at KES 80,000/semester (~KES 160,000/year) is relatively affordable for a private university IT security programme.
Kenya's growing digital economy, regulatory requirements, data protection laws, and cyber threats create very high demand for qualified IT security and audit professionals.
Programme covers both IT security and IT audit, providing versatile skills for security, audit, and governance career paths.

Against it

Only one primary university (Kabarak) offers this specific programme, limiting choice for prospective students.
Programme requires CS/IT background with Second Class Upper or Lower with PGDip, which may exclude some graduates.
IT security and audit is a rapidly evolving field, requiring continuous learning and updating of knowledge beyond the programme.
Online option at KES 53,700/semester may have limited practical hands-on components compared to on-campus delivery.

What it costs

Tuition at both ends of the market, and how to pay for it.

What it costs, and where

Against 191 technology courses

Public266k to 266k

266k at Technical University of Kenya266k at Technical University of Kenya

Private160k to 160k

160k at Kabarak University160k at Kabarak University

Annual tuition in Kenyan shillings, rounded. The upright tick is the median for this field, so a bar sitting entirely to its right is an expensive programme by the standards of its own subject.

The fine print

Kabarak MSc ITSA 160K/yr (kabarak.ac.ke). TUK ICT 266K/yr (eafinder.com). JKUAT unverified.

Kabarak University offers financial aid for eligible students. HELB postgraduate loans are available for Kenyan students. ISACA supports IT audit and governance professional development. ISC2 supports information security certifications. IIA supports internal audit professional development. The programme's IT security and audit focus attracts industry and professional body funding.

Funding options

Kabarak University Financial Aid
HELB Postgraduate Loan
ISACA Professional Development Funding

Scholarships

3 recorded

Kabarak University Financial Aid
GrantKsh 300,000Kenyan
Kabarak University offers financial aid for eligible students demonstrating academic merit and financial need.
HELB Postgraduate Loan
LoanKsh 200,000Kenyan
Kenyan students pursuing postgraduate IT security and audit studies at recognised universities.
ISACA Professional Development Funding
GrantKsh 400,000
ISACA supports IT governance, audit, risk, and cybersecurity professional development, providing funding for training and certifications globally.

Getting in

The grades, the alternatives, and who accredits the award.

What you need

KCSE mean grade: N/A (Postgraduate)
Alternative entry: The programme accepts graduates from computer science, IT, and related computing disciplines. Two-year programme with on-campus and online options. Kabarak requires Second Class Upper or Lower with PGDip or research publications. On-campus tuition KES 80,000/semester, online KES 53,700/semester. Kabarak is ISO 9001:2015 certified.

How you are assessed

4 components

Coursework and Assignments
Coursework30% of the mark
Continuous assessment through coursework assignments, audit projects, security analysis, case studies, and class participation.
Written Examinations
Examination30% of the mark
Written examinations covering IT security, IT audit, risk management, and compliance, conducted at end of each semester.
Practical Security and Audit Assessment
Practical40% of the mark
Assessment of practical exercises, penetration testing, audit projects, forensic analysis, security assessments, and hands-on security and audit projects.
Research Thesis
Research100% of the mark
Original research thesis on an IT security and audit topic, demonstrating mastery of research methods and IT security knowledge, assessed through written submission and oral defence.

Accreditation

The programme is accredited by the Commission for University Education (CUE). Kabarak University offers MSc in IT Security and Audit through its School of Science, Engineering and Technology, with on-campus and fully online options. Kabarak is ISO 9001:2015 certified. The programme meets CUE standards for postgraduate IT security and audit training. CA operates KE-CIRT for cyber security and ODPC enforces data protection in Kenya.

Accredited by

Commission for University Education (CUE)
Academic accreditationRequired
Programme accredited by CUE. Kabarak University offers MSc in IT Security and Audit through its School of Science, Engineering and Technology. Kabarak is ISO 9001:2015 certified. The programme meets CUE standards for postgraduate IT security and audit training.
Information Systems Audit and Control Association (ISACA)
Professional accreditation
ISACA provides CISA, CISM, CRISC certifications. Graduates may benefit from ISACA professional certifications for career advancement in IT audit and security.

Where it leads

The roles it opens, and what you leave with.

Where graduates go

6 roles

IT Security Manager
Very high demandKsh 140,000 to Ksh 600,000
Manages IT security in organisations, overseeing security strategy, policies, controls, compliance, and ensuring IT assets are protected.
IT Auditor
Very high demandKsh 130,000 to Ksh 550,000
Conducts IT audits, overseeing audit planning, execution, reporting, IT controls evaluation, and ensuring IT controls effectiveness and compliance.
Cybersecurity Analyst
Very high demandKsh 130,000 to Ksh 550,000
Monitors and analyses cyber threats, overseeing threat detection, incident analysis, security monitoring, and supporting cyber defence operations.
Compliance Officer
High demandKsh 120,000 to Ksh 500,000
Manages IT compliance, overseeing regulatory compliance, data protection compliance, audit compliance, and ensuring organisational IT compliance.
Risk Manager
High demandKsh 130,000 to Ksh 550,000
Manages IT risks, overseeing risk assessment, risk analysis, risk treatment, risk monitoring, and ensuring effective IT risk management.
University Lecturer
High demandKsh 130,000 to Ksh 500,000
Teaches IT security and audit in universities, conducting research and training future IT security and audit professionals.

Graduate outcomes

Graduates pursue careers as IT security managers, IT auditors, and cybersecurity analysts in banks, audit firms, government, and consulting firms.

Where these fields lead

8 careers

Tools you will learn

Kali Linux
SoftwarePrimary
Penetration testing and security auditing platform with pre-installed security tools for ethical hacking, vulnerability assessment, and security testing.
ACL Analytics
SoftwarePrimary
Data analysis software for IT audit, continuous audit, control testing, fraud detection, and IT audit data analysis.
Wireshark
Software
Network protocol analyser for network traffic analysis, packet capture, network security analysis, and network troubleshooting.
Nessus
Software
Vulnerability scanner for vulnerability assessment, security scanning, compliance checking, and identifying security vulnerabilities.

Industry links

Common misconceptions

IT security and audit is just about checking passwords.
The programme involves IT audit, risk management, governance, penetration testing, forensics, compliance, and research, covering comprehensive IT security and audit.
This programme is only for IT graduates.
The programme accepts graduates from computer science, IT, and related fields, including those with PGDip in Computer Science or extensive research experience.
There is limited demand for IT audit professionals in Kenya.
Kenya's growing digital economy, regulatory requirements, data protection laws, and cyber threats create very high demand for qualified IT security and audit professionals.
IT audit is the same as financial audit.
While related, IT audit focuses on IT systems, controls, security, and governance, while financial audit focuses on financial statements and accounting.
A master's in IT security and audit is redundant after IT certifications.
The master's provides comprehensive security and audit knowledge, research capability, and career progression to senior IT security management and CISO/CIO positions.
IT security and audit has no career prospects outside IT companies.
Every organisation with IT systems needs IT security and audit professionals, including banks, audit firms, government, healthcare, manufacturing, and NGOs.