Security Engineer

COMESA CLEARING HOUSE

VACANCIES

Background

The COMESA Clearing House (CCH) is an institution of the Common Market for Eastern and Southern Africa (COMESA) mandated to contribute to the advancement of regional economic integration by facilitating efficient cross-border payments and settlement among Member States. Headquartered in Harare, Zimbabwe, CCH develops and operates regional payment infrastructure aimed at reducing the cost and complexity of cross-border transactions and supporting increased intra-regional trade.

CCH operates the Regional Payment and Settlement System (REPSS), which facilitates cross-border settlement among participating countries, and is currently implementing the Digital Retail Payments Platform (DRPP), a regional initiative designed to enable fast, affordable, secure and interoperable cross-border retail payments. The DRPP is built on the Mojaloop open-source model, providing an interoperable foundation for connecting participating financial institutions and payment service providers across the region. As part of the DRPP infrastructure, CCH is also implementing a financial crime detection system based on Tazama to support transaction monitoring and strengthen the platform’s ability to identify and manage fraud and other financial crime risks.

Through this infrastructure, the DRPP is intended to strengthen the regional digital payments ecosystem, support more efficient and accessible digital financial services, and contribute to increased regional trade and economic integration.

Applications are invited from suitably qualified and experienced professionals from COMESA Member States for the following full-time, project-funded positions to support the implementation and operation of the DRPP.

JOB DESCRIPTION: Security Engineer

Job Title: Security Engineer
Duty Station: Zimbabwe / Remote. May require travel within COMESA

JOB PURPOSE

Own the information security assurance function for the DRPP, covering the confidentiality, integrity, availability, and data protection of the platform and all data it processes. Operate a shift-left security model where security controls are applied as close as possible to the creation of applications and infrastructure, in conjunction with the full technology team. Also responsible for Microsoft 365 internal IT security as a minor but real part of the role.

MAIN DUTIES AND ACCOUNTABILITIES

• Own the confidentiality, integrity, availability, and data protection posture of the DRPP platform in conjunction with the technology team.
• Own IAM for AWS production and on-premises staging environments, including users, roles, policies, and MFA.
• Manage HSMs and key ceremony processes, both cloud-based and physical where applicable.
• Own secrets management via HashiCorp Vault, including rotation schedules, access controls, and audit trails.
• Maintain mTLS certificates and API signing certificates for DFSP integrations; oversee Istio service mesh mTLS configuration.
• Set and maintain secure coding standards and conduct application security reviews in conjunction with software engineers.
• Define infrastructure security requirements and review platform engineer implementations.
• Own security incident response in conjunction with the SRE Engineer.
• Maintain compliance evidence against scheme security and cyber resilience requirements.
• Conduct regular access reviews and privilege audits.
• Oversee Microsoft 365 security configuration and internal IT security, estimated at 10 to 20 percent of role time.
• Manage the relationship with any outsourced cybersecurity provider engaged for SOC monitoring and penetration testing.

MINIMUM ACADEMIC QUALIFICATIONS AND PROFESSIONAL EXPERIENCE

• Relevant undergraduate degree in Computer Science, Information Security, or a related discipline. Relevant professional certification, such as CISSP, CISM, CEH, or equivalent, is strongly preferred. A relevant postgraduate qualification is an advantage.
• 5+ years of experience in information security, with a focus on cloud environments and financial services.
• Production IAM experience in an AWS environment, including roles, policies, and privilege management.
• HSM operations experience, including key ceremonies, custodian processes, and audit trails.
• Secrets management in a production payment or financial services environment, with HashiCorp Vault experience preferred.
• Practical experience applying shift-left security practices, including secure code review, threat modelling, and security requirements definition.
• Experience managing a security handover or credential rotation in a live production system.
• Be a national of a COMESA Member State.

COMPETENCIES

• Deep understanding of security frameworks, IAM, and cryptography.
• Strong analytical and investigative skills.
• Ability to embed security into development and operations processes.
• Excellent communication skills to articulate security risks to technical and non-technical audiences.
• High ethical standards and integrity.

LANGUAGES

Fluency in English and a working knowledge of French and/or Arabic will be an added advantage.

PERIOD OF APPOINTMENT

This is a grant-funded contractual position. The duration of the engagement is not fixed and will be subject to the continued availability of grant funding.

CLOSING DATE FOR APPLICATION

Applications, including a detailed Curriculum Vitae, should be emailed to the Executive Secretary of COMESA Clearing House, 4 Purbeck Close, Highlands, Harare, Zimbabwe. Email: info@comesach.org  no later than 21stSeptember 2026. Applications received after this date will not be considered.