Information Security Officer ( Talent Pool )

Information Security Officer (Talent Pool) (Selby)

Reference Number:ISOAKP

Description:

SBV seeks an Information Security Officer who will be accountable for delivering upon the strategic direction set in protecting SBV tech and data. This includes being a key partner in the design of success factors, solutions, and compliance.

Implement the Technology Strategy & Innovation for your area of responsibility

• Organize outputs aligned to the Technology risk strategy, internal controls, and budget of internal resourcing and partnerships to assure Technology Compliance to best practice and regulatory compliance (including but not limited to data protection compliance (e.g., POPI and GDPR), ECT Act, ESG, Cyber laws).
• Manage and coordinate a Zero data or Technology loss approach, internal controls, and budget of internal resourcing and partnerships to manage and optimize the Cyber Risk landscape. Drive a proactive, predictive, and continuous improvement Cyber Risks managed environment.
• Drive the Information Technology Security Programme across the SBV landscape to protect its applications and supporting infrastructure from both internal and external threats targeting zero downtime, zero audit findings, and a single view of Technology Risk.
• Implement and continuously enhance an information security management framework.
• Develop and implement Technology Security policies and standards that support and enable business strategy at the strategic planning, tactical, and operational business unit levels.
• Form and cascade a communication plan to the Technology team relating to the compliance of IT Security Policies, Standards, and Guidelines, escalating non-compliance matters to the CTO.

Execute Analysis & Planning Activities

• Research, develop and maintain a knowledge base of the IT threat landscape, security trending, regulatory requirements, mobile and other new technologies, and best practices to mitigate and plan against threats.
• Contribute to the organization’s overall technology planning by providing current knowledge and an understanding of future technologies.
• Create and manage a repository for all security-related documentation.
• Conduct reviews of applications, systems, infrastructure, databases, and processes as required.
• Annual review of IT Security Policies, Standards, and Guidelines according to technology objectives and update in accordance with changes in the organization and legislation.
• Craft a viable roadmap of activities, post collaboration with internal stakeholders, linked to the technology strategy but sequenced in alignment with organizational readiness.

Implement the Design for your Area of Responsibility

• Design and manage a roadmap for information security related to internal controls, compliance, regulatory, and a proactive risk mitigation plan for the Technology department.
• Design, implement, and monitor a comprehensive enterprise information security and IT risk management program in alignment with the Technology Risk strategy.
• Contribute to project risk management consulting and technical reviews as required.
• Cascade the Enterprise risk framework into the Technology Risk Framework and functional area responsibilities. Provide SME guidance and consultancy in solution design and/or daily operations across the SBV ecosystem.

Implement & Execute on activities within your area of responsibility

• Build and measure business relationships with key internal and external stakeholders to proactively consult and mitigate security threats.
• Lead programs of work (of various complexity) pulling in necessary stakeholders to deliver agreed outcomes and measure the adoption of Technology Security solutions e.g., logical access management or IT Security risk assessments and penetration tests toward zero audit findings.
• Provide consulting and engagement services to various business units in the procurement process and/or any investigative/exploratory ventures not limited to investigation, RFI, RFQ, selection, and assessments of current technologies. Benchmark best of breed security practices.
• Provide a recommendation to senior management on the fit of the product/service against SBV technology standards and governance.
• Establish relevant internal control metrics and audits to measure outcomes and performance related to security.
• Advise Technology business partners on regulatory, compliance (POPI, PAIA, etc.), and/or legal requirements as it relates to securing data, as well as project manage internal controls to mitigate threats.
• Create and manage a risk register and IT risk management schedule and drive all information and technology risks to closure.
• Review reporting templates in relation to audience and value add adjusting and implementing new templates as needed.
• Compile reports/BI as per agreed frequency.
• Review any draft reports provided by the team, making amendments as required to be fit for distribution/submission to senior management for final review.

Risk & Quality Management

• Develop and maintain an internal security audit framework to implement standards toward zero downtime and zero audit findings.
• Constant management of general control reviews, technical system reviews including Penetration Testing aligned to the Risk strategy of zero audit findings and material breaches.
• Co-ordinate and track the implementation of remediation plans in accordance with agreed upon timeframes.
• Management and coordination of incidents and consult with disciplinary and legal matters.
• Drive all internal controls to fully automated controls, zero audit findings, and a predictive/proactive view of risks. Formulate vendor/supplier standards for information security.
• Contribute and formalize a documented outcome for Due diligence, RFI, RFP processes.
• Conduct regular (minimum annual) reviews for security review for vendors or technology suppliers.
• Maintain and manage and consult on matters relating to BCP, DR, and high availability. Verify an updated 2-year plan on DR and related reporting.
• Escalation point for Technology security risks, incidents, and internal controls within the Group.
• Consolidate and review monthly payments to vendors providing an analysis on the spend.
• Track and monitor the spend vs the forecast and submit the findings for approval.
• Provide input to the departmental budget, reporting on monthly expenditure and craft proposals for funding.
• Create a cost catalogue linked to prescribed vendors and potential new vendors that will form the blueprint for all other departments in SBV.

Drive the proactive audit framework and compliance

• Implement and manage the technology self-audit framework. Logical access, physical access, change management, security controls (hardware, software, and data levels).
• Liaise with SBV internal audit to ensure relevance of scope prior to any internal audits.
• Implement additional processes, such as Segregation of Duties, Password Safes, and Audit trails, to address the risk posed by privileged IT users.
• Implement and validate reviews according to policies and standards set out (across PM Lifecycle and SDLC).
• Create and manage partnerships to manage, maintain, and optimize Technology Risks toward a future-focused innovative Strategy.

Create awareness of IT Security good practices to the IT end user and technical community

• Develop, implement, and drive an awareness and communication plan for the technology business unit, greater business and executives that is aligned with strategy and considers a range of risks and themes.
• Measure the effectiveness of the awareness plan through sampling, surveys, tests, attendance registers, or change management initiatives.

People Management

• Establish, embed, and maintain Information security standards, including continuous improvement of working processes, effective use of organization-wide approaches to goal setting, personal development planning, and motivation for a high performing team. Continuously explore ways of improving the team's toolkit and output and a proactive mindset.
• Create an environment conducive to cross-functional skills transfer.
• Create a conducive environment that translates into productivity and high morale within SBV delivering on key performance areas.
• Manage the Talent Management Process within one’s department.
• Manage the end-to-end performance management process of employees.
• Adhere to legislative requirements, company policies, and procedures in respect of employment Health and safety practices.
• Manage overtime/illegal overtime of one’s department through proper planning and staff rotation inclusive of driving the time and attendance system within one’s department.
• Draft and execute training plans in conjunction with the Organisational Development team.
• Create and implement strategies in collaboration with Change Management & HR to evaluate and maintain employee satisfaction.
• Align to the Transformation and BBB-EE initiatives to ensure sustainable alignment to the company scorecard.
• Act as a change management architect in periods of change to ensure continuity.
• Facilitate the necessary presentations, workshops, or forums to ensure consistent and accurate communication is given across one’s department.

Drive the organisation culture within one’s centre

• Drive the department’s values while inspiring confidence and generating excitement, enthusiasm, and commitment towards the mission.
• Serve as a leader of the culture program driving the desired behaviours and encouraging employee engagement.
• Create and implement strategies in collaboration with Change Management & HR to evaluate and maintain employee satisfaction.
• Drive Transformation and BBB-EE initiatives to ensure sustainable alignment to the company scorecard.

Provide leadership to employees within the organisation, creating a winning culture and high morale

• Lead as an Ambassador and executor of Change.
• Act as a change management architect in periods of change to ensure continuity to operations.
• Effectively communicate and embed new processes and procedures as they occur addressing or escalating matters/concerns to the SME’s (subject matter experts) when required.
• Facilitate the necessary presentations, workshops, or forums to ensure consistent and accurate communication is given across one’s centre/s.

Requirements

• 7 years’ experience in Technology Security or Risk Management roles of which should include:
• 4 years in Technology Policy writing (measurement of controls against Policy).
• 4 years’ experience in designing, implementing, and closing Technology general controls gaps.
• 3 years’ experience in directly assessing and communicating Risk Exposures and developing risk mitigation plans.
• 3 years’ experience in coordinating large projects or initiatives across multiple areas.
• 4 years’ experience in people management, including coaching and mentoring.
• IT related bachelor’s degree or Degree in Computer Science, IT Best practice (COBIT, ITIL etc).
• Professional Registration/Membership: Information Security Forums; ISACA; ISC2 (advantageous).
• Security related certification (CISSP, CISM, CRISC, CISA, ISO 27001) (Advantageous).

NB: Communication will be limited to shortlisted applicants only.

SBV recruitment is committed to transformation and diversity alignment.

#J-18808-Ljbffr