Principal IT Engineer

NawiriGroup is foremost known as a leading safari travel group, offering great personalised nature-based travel experiences across the African continent. Our core purpose goes beyond delivering exceptional safaris. We are a platform that connects local communities, expert partners, investors, and travellers to drive positive impact at scale within some of Africa’s most iconic wilderness areas.

Since inception, we’ve supported national parks, community-led conservancies, local communities and governments with many initiatives and millions of dollars in their efforts to safeguard and manage some of Africa’s most important wilderness areas. We believe travel should be a force for good and our vision is to use responsible travel to create a sustainable and prosperous future for natural ecosystems in Africa and the local people living in and around these unique, globally important areas.

Today, through the Group’s various subsidiaries across multiple countries, which includes Asilia Africa, a leading safari operator with 17 bespoke camps and lodges across Kenya, Tanzania, and Uganda, with a full-service DMC offering, and the multi-award-winning African safari tour operator Go2Africa, we employ close to 1,300 people in sub-Saharan Africa all dedicated to delivering immersive experiences while working towards our goal of delivering impact at scale.

Purpose Driven

• Our shared purpose is encapsulated in our group name - ‘Nawiri’ is Kiswahili for ‘to flourish/thrive’, reflecting our vision of creating a future where vital ecosystems and local communities thrive together.

• We are proud as a group to be B Corp certified, a testament to our dedication to balancing the needs of people, planet, and profit in everything we do. Our journey with B Corp started more than a decade ago when Asilia qualified in 2012, the first African Travel company to do so.

• Last financial year we contributed US$9.8m to nature protection and positive impact projects. We continue to grow our impact reach and agenda.

• We have ambitious commercial growth plans and are expanding our operational, commercial, analytical and technology capabilities to enable the further scaling of both our guest experiences and travel offerings.

Why should you work for us?

• Join a team that has continuously led the way in our industry, ranging from creating cutting-edge technology platforms to deploying innovative solutions to lead the way in sustainable operations.

• We take pride in creating a culture where people grow, find purpose, and contribute to progress that reaches far beyond the organisation. Training and development are at the heart of this journey, and we are proud of the number of in-house programmes that we have available, including a training library offering over 130 different training modules.

• Enjoy the flexibility of a hybrid working arrangement to get the most out of your working hours. Combine work in one of the Nawiri Group offices, located in the picturesque cities of Cape Town, Nairobi, Arusha, and London, with the option of remote work.

ROLE SUMMARY

We are looking for an experienced Principal Engineer to join our Group IT team and act as the senior technical authority across our infrastructure environment. This is a senior technical leadership role for someone who has progressed beyond operational engineering and is comfortable taking ownership of architecture, technical standards, cybersecurity, infrastructure resilience and the development of a geographically distributed team.

The environment spans multiple businesses, countries, offices and remote operational sites. The successful candidate therefore needs to be comfortable working across a complex and widely distributed IT environment and leading engineers with different levels of experience, personalities and technical specialisations.

KEY RESPONSIBILITIES

Technical Leadership

• Establish Group infrastructure architecture, technical standards and roadmaps in partnership with the Head of IT.

• Review and approve complex designs and changes, identify technical debt and make sound decisions across security, availability, scalability, cost and supportability.

• Provide senior escalation and technical direction to engineers, specialists, regional teams and strategic vendors.

• Ensure critical platforms have clear primary and secondary owners, with current documentation and shared knowledge.

   

People Leadership

• Lead experienced engineers across locations, cultures, disciplines and differing operational priorities through credibility, trust, coaching and clear direction.

• Delegate effectively, recognise individual strengths and develop future technical leaders without becoming the sole resolver of every complex issue.

• Build a collaborative engineering culture centred on ownership, professional behaviour and consistent technical practices.

Infrastructure Architecture

• Design secure, resilient and scalable infrastructure across Group entities and locations.

• Lead the integration of new businesses, sites and environments into Group standards, standardising platforms where practical.

• Maintain an infrastructure and technical-security roadmap that supports Group growth and operational resilience.

Major Incident Response

Act as the senior technical lead during major infrastructure and cybersecurity incidents. Lead investigation, containment, isolation and recovery; coordinate engineers and technical providers; preserve technical evidence; and convert post-incident findings into infrastructure and security improvements. The Head of IT retains overall incident command, business escalation and executive communication.

Technical Scope:

Microsoft Cloud and Identity

• Own architecture oversight across Azure, Microsoft 365, Entra ID, Active Directory and hybrid Microsoft environments.

• Set standards for identity, Conditional Access, MFA, privileged access, least privilege and separation of administrative access.

• Review cloud and identity security, reduce unnecessary privilege and strengthen access controls across the Group.

Networks and Firewalls

• Define enterprise network and firewall standards covering Fortinet or equivalent platforms, routing, switching, VLANs, VPN, SD-WAN, secure remote access and ZTNA concepts.

• Improve segmentation and controls between users, servers, cloud environments and critical infrastructure, reducing unnecessary lateral access.

• Provide architecture guidance and senior escalation for complex network and connectivity issues.

Cybersecurity Engineering

• Lead technical security architecture across EDR and XDR, identity security, privileged access, endpoint hardening, application control and ransomware resilience.

• Work with MDR, SOC and forensic providers to improve detection coverage, logging, alerting, technical response and evidence availability.

• Translate vulnerabilities, penetration-test findings and security risks into prioritised, practical remediation, including compensating controls where immediate remediation is not possible.

• Apply Zero Trust, least privilege, defence-in-depth and recognised control frameworks, while independent governance and regulatory assurance remain outside this role.

Backup, Disaster Recovery and Resilience

• Provide architecture oversight for enterprise, immutable and off-site or cloud backup platforms, disaster recovery and business-service recovery.

• Ensure critical platforms have protected backup infrastructure, documented recovery plans and regular restore and disaster-recovery testing.

• Strengthen resilience against ransomware, privileged-account compromise and other high-impact failures.

Vulnerability Endpoint and Patch Management

• Set technical vulnerability and patch-management standards, prioritising internet-facing, identity, firewall, remote-access and critical-server risks.

• Identify unsupported or end-of-life infrastructure and guide engineers on remediation planning.

• Oversee endpoint and remote-management standards, ensure RMM and remote-access tools are controlled and inventoried, and reduce unnecessary administrative access.

Required Experience

• At least 10 years in enterprise infrastructure, networking, cloud or cybersecurity, including five years in senior engineering, architecture or technical leadership.

• Proven leadership of experienced, geographically distributed technical teams across multiple sites, offices or countries.

• Strong architecture experience across Azure, Microsoft 365, Entra ID, Active Directory, Windows Server and hybrid-cloud environments.

• Strong enterprise networking and firewall experience, including Fortinet or an equivalent platform, segmentation and secure remote access.

• Practical experience in backup and disaster recovery, EDR or XDR, security monitoring, vulnerability management and cybersecurity incident response.

• Strong technical documentation, architecture, scripting and infrastructure-automation capability, including PowerShell or a similar language.

Core Technical Knowledge

• Cloud and identity: Azure, Microsoft 365, Entra ID, Active Directory, Conditional Access, MFA, privileged access and hybrid Microsoft environments.

• Network and security: Fortinet or equivalent firewalls, routing and switching, VLANs, segmentation, VPN, SD-WAN, ZTNA, EDR or XDR, MDR or SOC and SIEM concepts.

• Resilience and operations: Windows Server, immutable backup, disaster recovery, ransomware recovery, vulnerability management, RMM, incident response and infrastructure automation.

• Security principles: Zero Trust, least privilege, defence in depth, identity security, incident response, CIS Controls, NIST Cybersecurity Framework and ISO 27001 principles.

EMPLOYMENT EQUITY

At Nawiri Group, we are committed to fostering diversity and inclusion. We encourage Employment Equity candidates and individuals with disabilities to apply. As an equal opportunities employer, we believe that a diverse workforce is key to our success. We welcome applications from individuals of all backgrounds, regardless of age, gender, disability, sexual orientation, race, religion, or beliefs.