Senior Specialist Cyber Security

Role purpose:

The purpose of the role is to manage, support and report on the vulnerability status of the Vodacom Group. To further provide security guidance and support to systems owner according to policies and requirements, best practice and local/international standards (PCI, SOX, ISO27001, GDPR, POPIA and Cyber Crime Bill of 2015) relevant to the technology security area. As a key member of the Vodacom Group Technology Security team, the candidate should be comfortable with driving information vulnerability management and communicating clearly with technical as well as non-technical audiences. 

Your responsibilities will include:

• The incumbent will direct, develop, implement and maintain a comprehensive Vodacom-wide vulnerability management strategy.
• Defining, implementing and efficiently maintaining technology security controls and requirements 
• Ensure timely delivery of technology security vulnerability reports and support for projects 
• Ensure compliance with Legal and Regulatory requirements 
• Provide SME input to Technology Security Policy requirements and procedures
• Support Technology Security awareness programs and educational efforts
• Provide accurate and timely reporting of technology security risks identified during project engagement and propose remediation and mitigation options
• Participate in creation and execution of technology security strategy 
• Ensure financial efficiency in Tech Security Solutions
• The role requires the individual to monitor information security governance, risk, and compliance by Vodacom Corporate IT, Mobile and Enterprise Business domains
• Ensure alignment of information security governance with the Vodacom’s business objectives, the information security strategy, plans and controls
• Ensure compliance with the applicable legislative and regulatory interpretation and corporate risk appetite.
• Engage with the stakeholders on vulnerability management compliance to control effectiveness and deficiencies in the design and operating effectiveness of information security controls, design and recommend opportunities for continuous improvement;
• Interpret and manage the controls and capabilities required for Vodacom to establish and comply with an information security management system in alignment with information security international best practice and/or industry standard(s);
• Manage and conduct formal information security risk analyses, reviews, tests, audits and/or self-assessments;
• Design appropriate remedial actions for identified risks, drive remediation of findings and management of risks and exemptions;
• Participate in IT general controls and compliance testing activities and/or audits;
• Report information security risks in an appropriate way for different audiences;
• Collaborate with various key stakeholders, and provide information security advice to stakeholders

The ideal candidate for this role will have:

• Diploma or Bachelor’s Degree in Computer Science, Information Systems, Systems Analysis, or other related field 
• Minimum of 3+ years of experience in Tech Security role where you meet business deliverables
• Knowledge of common information technology management / compliance frameworks such as ISO/IEC 27001, SOC 2, SOX, ITIL, COBIT, and NIST.
• Knowledge of legal, regulatory and privacy requirements, such as Personally Identifiable Information (PII) Protection and Payment Card Industry (PCI)/Data Security Standard.
• Proven experience in managing vulnerabilities and the use of various tools like nCircle, Rapid 7, Tenable Nessus, Open VAS, Green Bone, Qualys. etc 
• Bug Bounty, Responsible disclosure knowledge
• A deep understanding of Technology Security risks and mitigating solutions
• A diverse security background with knowledge in several areas including layered security architecture; internet protocols; firewalls; VPN technologies, IDS/IPS, network access control and network segmentation, anti-malware and spam technologies; risk and vulnerability assessments, and compliance.
• Security concepts related to DNS, routing, authentication, VPN, proxy services and DDOS mitigation technologies
• Windows, UNIX and Linux operating systems
• Strong organizational skills and an entrepreneurial drive with a history of recruiting and developing high-performing teams
• Ability to work under time and resource pressure 
• An ability and desire to communicate and work with a broad set of stakeholders
• A customer-focused, responsive, and transparent attitude