INFORMATION SECURITY OFFICER Permanent

Description

• Our client seeks an Information Security Officer who will be Accountable to deliver upon the strategic direction that has been set in protecting the company tech and data. This includes being a key partner in the design of success factors, solutions and compliance

Implement the Technology Strategy & Innovation for your area of responsibility

• Organize outputs aligned to the Technology risk strategy, internal controls and budget of internal resourcing and partnerships to assure Technology Compliance to best practise and regulatory compliance (including but not limited to data protection compliance (e.g., POPI and GDPR), ECT Act, ESG, Cyber laws.
• Manage and coordinate a Zero data or Technology loss approach, internal controls and budget of internal resourcing and partnerships to manage and optimise the Cyber Risk landscape. Drive a proactive, predictive and continuous improvement Cyber Risks managed environment
• Drives the Information Technology Security Programme across the company landscape to protect its applications and supporting infrastructure from both internal and external threats targeting zero downtime, zero audit findings and single view of Technology Risk
• Implement and continuously enhance an information security management framework
• Develop and implement Technology Security, policies and standards that supports and enables business strategy at the strategic planning, tactical and operational business unit levels
• Form and cascade a communication plan to the Technology team relating to the compliance of IT Security Policies, Standards and Guidelines. Escalating non-compliance matters to CTO

Execute Analysis & Planning Activities 

• Research, develop and maintain a knowledge base of the IT threat landscape, security trending, regulatory requirements, mobile and other new technologies and best practices to mitigate and plan against threats
• Contribute to the organization’s overall technology planning by providing current knowledge and an understanding of future technologies
•  Create and manage a repository for all security related documentation.
• Conduct reviews of applications, systems, infrastructure, databases and processes as required
•  Annual review of IT Security Policies, Standards and Guidelines according to technology objectives and update in accordance to changes in the organization and legislation
• Craft a viable roadmap of activities, post collaboration with internal stakeholders, linked to the technology strategy but sequenced in alignment with organisational readiness

Implement the Design for your Area of Responsibility

• Design and manage a roadmap for information security related to internal controls, compliance, regulatory and a proactive risk mitigation plan for the Technology department
• Design, implement and monitor a comprehensive enterprise information security and IT risk management program in alignment with the Technology Risk strategy.
• Contribute to project risk management consulting and technical reviews as required.
• Cascade of the Enterprise risk framework into the Technology Risk Framework and functional area responsibilities. Provide SME guidance and consultancy in solution design and/or daily operations across the company ecosystem

Implement & Execute on activities within your area of responsibility

• Build and measure business relationships with key internal and external stakeholders to proactively consult and mitigate security threats
• Lead programs of work (of various complexity) pulling in necessary stakeholders to deliver agreed outcomes and measure the adoption of Technology Security solutions e.g., logical access management or e.g., IT Security risk assessments and penetration tests toward zero audit findings
• Provide consulting and engagement services to various business units in the procurement process and/or any investigative/exploratory ventures. Not limited to investigation, RFI, RFQ, selection and assessments of current technologies. Benchmark best of breed security practices
• Provide a recommendation to senior management on the fit of the product/service against the company technology standards and governance
• Establish relevant internal control metrics and audits to measure outcomes and performance related to security
• Advise Technology business partners on regulatory, compliance (POPI, PAIA, etc) and/or legal requirements as it relates to securing of data as well as project manage internal controls to mitigate threats
• Create and manage a risk register and IT risk management schedule and drive all information and technology risks to closure
• Review reporting templates in relation to audience and value add adjusting and implementing new templates as need be
• Compile reports/BI as per agreed frequency
• Review any draft reports provided by the team, making amendments as required to be fit for distribution/submission to senior management for final review

Risk & Quality Management

• Develop and maintain an internal security audit framework to implement standards toward zero downtime and zero audit findings.
• Constant management of general control reviews, technical system reviews including Penetration Testing aligned to the Risk strategy of zero audit findings and material breaches
• Co-ordinate and track the implementation of remediation plans in accordance with agreed upon timeframes
• Management and coordination of incidents and consult with disciplinary and legal matters
• Drive all internal controls to full automated controls, zero audit findings and predictive/proactive view of risks. Formulate vendor/supplier standards for information security
• Contribute and formalise a documented outcome for Due diligence, RFI, RFP processes
• Conduct regular (minimum annual) reviews for security review for vendors or technology suppliers
• Maintain and manage and consult on matters relating to BCP, DR and high availability. Verify an updated 2-year plan on DR and related reporting.
• Escalation point for Technology security risks, incidents and internal controls within the Group

Financial Management

• Consolidate and review monthly payments to vendor providing an analysis on the spend
• Track and monitor the spend vs the forecast and submit the findings for approval
• Provide input to the departmental budget, reporting on monthly expenditure and craft proposals for funding
• Create a cost catalogue linked to prescribed vendors and potential new vendors that will form the blueprint for all other departments in the company

Drive the proactive audit framework and compliance

• Implement and manage the technology self-audit framework. Logical access, physical access, change management, security controls (hardware, software and data levels).
• Liaise with the company internal audit to ensure relevance of scope prior to any internal audits
• Implement additional processes, such as Segregation of Duties, Password Safes and Audit trails, to address the risk posed by privileged IT users.
• Implement and validate reviews according to policies and standards set out (across PM Lifecycle and SDLC).
• Create and manage partnerships to manage, maintain and optimise Technology Risks toward a future focused innovative Strategy

Create awareness of IT Security good practices to the IT end user and technical community

• Develop, implement and drive an awareness and communication plan for the technology business unit, greater business and executives that is aligned with strategy and considers a range of risks and themes.
• Measure the effectiveness of the awareness plan through sampling, surveys, tests, attendance registers or change management initiatives

People Management

• Establish, embed, and maintain Information security standards, including continuous improvement of working processes, effective use of organization-wide approaches to goal setting, personal development planning, and motivation for a high performing team. Continuously exploring ways of improving the team’s toolkit and output and a proactive mindset
• Create an environment conducive to cross-functional skills transfer.
• Creates a conducive environment which translates into productivity and high morale within the company delivering on key performance areas
•  Manage the Talent Management Process within one’s department
• Manage the end-to-end performance management process of employees
• Adhere to legislative requirements, company policies and procedures in respect of employment Health and safety practices
• Manage overtime / illegal overtime of one’s department through proper planning and staff rotation inclusive of driving the time and attendance system within one’s department
• Draft and execute training plans in conjunction with the Organisational Development team
• Create and implement strategies in collaboration with Change Management & HR to evaluate and maintain employee satisfaction
• Align to the Transformation and BBB-EE initiatives to ensure sustainable alignment to the company scorecard
• Act as a change management architect in periods of change to ensure continuity
• Facilitate the necessary presentations, workshops or forums to ensure consistent and accurate communication is given across one’s department

Drive the organisation culture within one’s centre

• Drive the department’s values while inspiring confidence and generating excitement, enthusiasm and commitment towards the mission.
• Serve as a leader of the culture program driving the desired behaviours and encouraging employee engagement
• Create and implement strategies in collaboration with Change Management & HR to evaluate and maintain employee satisfaction
• Drive Transformation and BBB-EE initiatives to ensure sustainable alignment to the company scorecard

Provide leadership to employees within the organisation, creating a winning culture and high morale

• Lead as an Ambassador and executor of Change
• Act as a change management architect in periods of change to ensure continuity to operations
• Effectively communicate and embed new processes and procedures as they occur addressing or escalating matters / concerns to the SME’s (subject matter experts) when required
• Facilitate the necessary presentations, workshops or forums to ensure consistent and accurate communication is given across one’s centre/s

Requirements
Minimum Requirements: Work Experience

• 7 years’ experience in Technology Security or Risk Management roles of which should include:
• 4 years in Technology Policy writing (measurement of controls against Policy)
• 4 years’ experience in designing, implementing and closing Technology general controls gaps
• 3 years’ experience in directly assessing and communicating Risk Exposures and developing risk mitigation plans
• 3 years’ experience in coordinating large projects or initiatives across multiple areas
• 4 years’ experience in people management, including coaching and mentoring

Minimum Requirements: Education

• IT related bachelor’s degree or Degree in Computer Science, IT Best practise (COBIT, ITIL etc)
• Professional Registration/Membership: Information Security Forums; ISACA; ISC2 (advantageous)
• Security related certification (CISSP,CISM,CRISC,CISA, ISO 27001) (Advantageous)