April 12, 2024 ADMIN
SBV seek a Information Security Officer who will be Accountable to deliver upon the strategic direction that has been set in protecting SBV tech and data. This includes being a key partner in the design of success factors, solutions and compliance
Implement the Technology Strategy & Innovation for your area of responsibility
Organize outputs aligned to the Technology risk strategy, internal controls and budget of internal resourcing and partnerships to assure Technology Compliance to best practise and regulatory compliance (including but not limited to data protection compliance (e.g., POPI and GDPR), ECT Act, ESG, Cyber laws.
Manage and coordinate a Zero data or Technology loss approach, internal controls and budget of internal resourcing and partnerships to manage and optimise the Cyber Risk landscape.Drive a proactive, predictive and continuous improvement Cyber Risks managed environment
Drives the Information Technology Security Programme across the SBV landscape to protect its applications and supporting infrastructure from both internal and external threats targeting zero downtime, zero audit findings and single view of Technology Risk
Implement and continuously enhance an information security management framework
Develop and implement Technology Security, policies and standards that supports and enables business strategy at the strategic planning, tactical and operational business unit levels
Form and cascade a communication plan to the Technology team relating to the compliance of IT Security Policies, Standards and Guidelines. Escalating non-compliance matters to CTO
Execute Analysis & Planning Activities
Research, develop and maintain a knowledge base of the IT threat landscape, security trending, regulatory requirements, mobile and other new technologies and best practices to mitigate and plan against threats
Contribute to the organization’s overall technology planning by providing current knowledge and an understanding of future technologies
Create and manage a repository for all security related documentation.
Conduct reviews of applications, systems, infrastructure, databases and processes as required
Annual review of IT Security Policies, Standards and Guidelines according to technology objectives and update in accordance to changes in the organization and legislation
Craft a viable roadmap of activities, post collaboration with internal stakeholders, linked to the technology strategy but sequenced in alignment with organisational readiness
Implement the Design for your Area of Responsibility
Design and manage a roadmap for information security related to internal controls, compliance, regulatory and a proactive risk mitigation plan for the Technology department
Design, implement and monitor a comprehensive enterprise information security and IT risk management program in alignment with the Technology Risk strategy.
Contribute to project risk management consulting and technical reviews as required.
Cascade of the Enterprise risk framework into the Technology Risk Framework and functional area responsibilities Provide SME guidance and consultancy in solution design and/or daily operations across the SBV ecosystem
Implement & Execute on activities within your area of responsibility
Build and measure business relationships with key internal and external stakeholders to proactively consult and mitigate security threats
Lead programs of work (of various complexity) pulling in necessary stakeholders to deliver agreed outcomes and measure the adoption of Technology Security solutions e.g., logical access management or e.g., IT Security risk assessments and penetration tests toward zero audit findings
Provide consulting and engagement services to various business units in the procurement process and/or any investigative/exploratory ventures Not limited to investigation, RFI, RFQ, selection and assessments of current technologies. Benchmark best of breed security practices
Provide a recommendation to senior management on the fit of the product/service against SBV technology standards and governance
Establish relevant internal control metrics and audits to measure outcomes and performance related to security
Advise Technology business partners on regulatory, compliance (POPI, PAIA, etc) and/or legal requirements as it relates to securing of data as well as project manage internal controls to mitigate threats
Create and manage a risk register and IT risk management schedule and drive all information and technology risks to closure
Review reporting templates in relation to audience and value add adjusting and implementing new templates as need be
Compile reports/BI as per agreed frequency
Review any draft reports provided by the team, making amendments as required to be fit for distribution/submission to senior management for final review
Risk & Quality Management
Develop and maintain an internal security audit framework to implement standards toward zero downtime and zero audit findings.
Constant management of general control reviews, technical system reviews including Penetration Testing aligned to the Risk strategy of zero audit findings and material breaches
Co-ordinate and track the implementation of remediation plans in accordance with agreed upon timeframes
Management and coordination of incidents and consult with disciplinary and legal matters
Drive all internal controls to full automated controls, zero audit findings and predictive/proactive view of risksFormulate vendor/supplier standards for information security
Contribute and formalise a documented outcome for Due diligence, RFI, RFP processes
Conduct regular (minimum annual) reviews for security review for vendors or technology suppliers
Maintain and manage and consult on matters relating to BCP, DR and high availability. Verify an updated 2-year plan on DR and related reporting.
Escalation point for Technology security risks, incidents and internal controls within the Group
Financial Management
Consolidate and review monthly payments to vendor providing an analysis on the spend
Track and monitor the spend vs the forecast and submit the findings for approval
Provide input to the departmental budget, reporting on monthly expenditure and craft proposals for funding
Create a cost catalogue linked to prescribed vendors and potential new vendors that will form the blueprint for all other departments in SBV
Drive the proactive audit framework and compliance
Implement and manage the technology self-audit framework. Logical access, physical access, change management, security controls (hardware, software and data levels).
Liaise with SBV internal audit to ensure relevance of scope prior to any internal audits
Implement additional processes, such as Segregation of Duties, Password Safes and Audit trails, to address the risk posed by privileged IT users.
Implement and validate reviews according to policies and standards set out (across PM Lifecycle and SDLC).
Create and manage partnerships to manage, maintain and optimise Technology Risks toward a future focused innovative Strategy
Create awareness of IT Security good practices to the IT end user and technical community
Develop, implement and drive an awareness and communication plan for the technology business unit, greater business and executives that is aligned with strategy and considers a range of risks and themes.
Measure the effectiveness of the awareness plan through sampling, surveys, tests, attendance registers or change management initiatives
People Management
Establish, embed, and maintain Information security standards, including continuous improvement of working processes, effective use of organization-wide approaches to goal setting, personal development planning, and motivation for a high performing teamContinuously exploring ways of improving the team’s toolkit and output and a proactive mindset
Create an environment conducive to cross-functional skills transfer.
Creates a conducive environment which translates into productivity and high morale within SBV delivering on key performance areas
Manage the Talent Management Process within one’s department
Manage the end-to-end performance management process of employees
Adhere to legislative requirements, company policies and procedures in respect of employment Health and safety practices
Manage overtime / illegal overtime of one’s department through proper planning and staff rotation inclusive of driving the time and attendance system within one’s department
Draft and execute training plans in conjunction with the Organisational Development team
Create and implement strategies in collaboration with Change Management & HR to evaluate and maintain employee satisfaction
Align to the Transformation and BBB-EE initiatives to ensure sustainable alignment to the company scorecard
Act as a change management architect in periods of change to ensure continuity
Facilitate the necessary presentations, workshops or forums to ensure consistent and accurate communication is given across one’s department
Drive the organisation culture within one’s centre
Drive the department’s values while inspiring confidence and generating excitement, enthusiasm and commitment towards the mission.
Serve as a leader of the culture program driving the desired behaviours and encouraging employee engagement
Create and implement strategies in collaboration with Change Management & HR to evaluate and maintain employee satisfaction
Drive Transformation and BBB-EE initiatives to ensure sustainable alignment to the company scorecard
Provide leadership to employees within the organisation, creating a winning culture and high morale
Lead as an Ambassador and executor of Change
Act as a change management architect in periods of change to ensure continuity to operations
Effectively communicate and embed new processes and procedures as they occur addressing or escalating matters / concerns to the SME’s (subject matter experts) when required
Facilitate the necessary presentations, workshops or forums to ensure consistent and accurate communication is given across one’s centre/s
Requirements
Minimum Requirements: Work Experience
7 years’ experience in Technology Security or Risk Management roles of which should include:
4 years in Technology Policy writing (measurement of controls against Policy)
4 years’ experience in designing, implementing and closing Technology general controls gaps
3 years’ experience in directly assessing and communicating Risk Exposures and developing risk mitigation plans
3 years’ experience in coordinating large projects or initiatives across multiple areas
4 years’ experience in people management, including coaching and mentoring
Minimum Requirements: Education
IT related bachelor’s degree or Degree in Computer Science, IT Best practise (COBIT, ITIL etc)
Professional Registration/Membership: Information Security Forums; ISACA; ISC2 (advantageous)
Security related certification (CISSP,CISM,CRISC,CISA, ISO 27001) (Advantageous)
NB: Communication will be limited to shortlisted applicants only
SBV recruitment is committed to transformation and diversity alignment
Work Level: Management
Job Type: Permanent
Salary: Market Related
EE Position: Yes
Location: Selby