How Mercy Omollo is breaking barriers for women in cybersecurity

Mercy's presence is calm but electric. She is a blend of sharp expertise and approachable warmth. As the second female president of the ISACA [Information Systems Audit and Control Association] Kenya Chapter in over 25 years, Mercy is rewriting the rules for women in technology.

But ask her about her title, and she’ll smile and say, “I’m just here to open doors for the next generation.”

Beyond the boardroom, Mercy is a mentor, a strategist, and a relentless advocate for inclusivity. “When young girls see me in this role, they stop asking ‘Can I?’ and start saying ‘I will,” she says.

Where did you grow up and what kind of sibling/child were you?

I grew up in Karen and Ongata Rongai. A better part of my childhood in Karen was growing up in a theological university where my parents worked, and where I got to be exposed to a lot about different cultures and countries given the university catered for a lot of foreign families. I am a first-born daughter so there were a lot of expectations on me setting a good example for my siblings. I was a curious child who loved to read a lot, history would fascinate me and my favourite subject back then was GHC, now referred to as social studies. However, I loved to play a lot and grew up playing basketball with the neighbourhood boys and girls.

Any fond memories from your childhood?

Oh yes! One of my childhood best friends went on to play basketball at pro level in Europe and the USA. I later discovered my passion for hockey and went on playing until club level and continental level playing with Strathmore University Scorpions club. I think most people get surprised that I play and love sports but I think it is a big part of me as I enjoy outdoor sports a lot. In high school, I would say I was the class clown and loved to joke a lot, but of course, being in a school that was serious about academics, there was a time for everything. I was a balanced child who kept my parents happy with good grades but also had fun with my friends, sometimes overdoing it.

Who or what inspired your career journey? Was there a defining moment that set you on this path?

When I was first introduced to computers back in the 90s, I was really fascinated and my curiosity began back then. I decided to pursue computer studies in high school, and later on, had to choose between law and a degree in information technology. I opted for the technology course. This set up the path for my career.

How was the transition into the job market?

I landed my first role two years after graduating. I worked for a pharmaceutical company and then tarmacked for some time before getting a role with Deloitte. A friend encouraged me to apply for the role as IT auditor, and after the interviews I got it. I like to say this was a defining moment in my career as I felt inadequate given I did not have much experience for the role but I had done some certifications in networking that helped me answer the queries during the interviews and demonstrate my passion for being in the technology space. When I joined, my boss told me ‘Nobody wakes up thinking about you’ meaning that only I would define how I pivot in my career and grab the opportunities presented to me. Over the years, I become deliberate about building my expertise in technology and cybersecurity risk management.

You are the current ISACA Kenya President and you have recently started a new role as Director of ICS and Technology Risk at a local multinational bank, what excites you most about your job?

The chance to provide my expertise and grow with an organisation that is dedicated to enhancing innovation and customer experience for both my internal and external stakeholders really excites me. The director role gives me a chance to play into what I have been doing as a professional throughout my career but also demonstrate my experience as an ISACA professional, showcasing what I have to offer and the knowledge gained from being part of this body and translating it into my work.

 Cybersecurity and risk management can be complex fields. What drew you to this space, and how has the journey been?

The ever-evolving landscape and its complexity drew me into this space. No single day is similar to another, therefore you have to keep up with the evolving risks and adapt dynamically to assist organisations deal with these risks. I have had to ensure I am up to date with current affairs in the technology space and have proper strategies to help deal with evolving risks and technologies that my organisation is deploying. Getting myself with like-minded individuals in the same space through professional associations like ISACA has made the journey smoother.

 What are some of the challenges you’ve faced as a woman in the tech and risk industry, and how did/do you navigate them?

During my career, when doing consulting, I faced a lot of doubts about my competency in the technology space due to my gender. When people realised I was competent in my assignments, they gave me respect. Not taking things personally and understanding the biases women face in this space, helped me to rise above this and find ways to showcase my competency.

You are the only second female to lead ISACA, how did that happen?

When I decided to run for office, I enlisted the support of male allies to help demonstrate my expertise. Given I had worked with them, it was easier to sell my vision to them. Women have been my biggest supporters and the strides we have made together are invaluable. Having a community of women technology leaders on the board and chapter has made my work easier because I can lean into the expertise they offer.

You hold multiple certifications in cybersecurity and risk. How important is continuous learning in your field?

Very important! For starters, it puts a foot in the door during the shortlisting and interview process for key roles. It also demonstrates your expertise in the field. With an ever-evolving cybersecurity landscape, you have to keep abreast with learning. It does not mean getting all the certifications but ensuring you build skills in the various niches of the cyberspaces you are operating in.

Many women struggle with imposter syndrome. Have you ever experienced this, and how do you overcome it?

I think imposter syndrome is a continuous battle you will face from time to time. Even at the pinnacle of what people would think is the ultimate place to be like ISACA Kenya President, I still face it occasionally. Leaning into a community of like-minded women who are in the same sector has helped me get going. They remind me of my self-worth. Reminding myself that I am worthy and deserve to be here based on my accomplishments is reason enough to keep going.

 What advice would you give to middle-level corporate women looking to break into leadership roles, especially in tech and risk management?

Get a mentor to guide you and share experiences on how you can navigate the same. If you can invest in a coach, the better. Get a sponsor at work to advocate for you whenever high-level decisions are being made. Investing in yourself through learning development is a must. Join professional associations and volunteer to serve to build networks because collaborating with other women in this field is a game changer.

 Outside your career, what are some of your favourite hobbies or activities that bring you joy?

Watching and playing outdoor sports. I am trying out tennis this year and loving it so far. I enjoy travelling, discovering new places and learning about people’s culture.

 If you could give advice to your younger self, what would it be?

This is the time to make your mistakes. They will get you down, but girl, rise and take a step at a time. You will learn from the mishaps and get back on your feet. It does get better. Lastly, those late nights will pay off in future!

 Looking ahead, what legacy do you hope to leave, professionally and personally?

Professionally, impact on organisations and the field of technology and cyber risk management. I want to be able to ensure more ladies join and remain in these sectors and I would like to be remembered as the one who played a role in helping them get roles in leadership in these fields and pave the way for sustainable programs to have more women join the technology space.

Personally, I would like my family and friends to remember me as a kind loving person who brought joy and impact into their lives in one way or another. I want my daughters to remember me as having given myself as a dedicated parent who helped them navigate life to become better humans despite falling short occasionally.

lmbuthia@ke.nationmedia.com