Business Information Security Officer -National, ZA at Nedbank

Job Purpose
The business information security officer must support the business cluster in the implementation and execution of the cyber resilience risk management framework that includes implementation of cyber risk assessments, strategy, cyber security programme, policies, standards, reporting of all cluster-specific cyber security programme elements and regulatory matters as it relates to cyber security.

Job Responsibilities

• Become the information security expert for the cluster by providing expert advice on information security matters;
• Ensure alignment and implementation of Cyber Risk Framework in cluster;
• Assess the cluster’s cyber security posture against good practices and industry standards;
• Contribute to the achievement of the organisation’s cybersecurity objectives by providing oversight and driving compliance to security policies and standards on cluster infrastructure;
• Build and maintain professional relationships by information sharing and professional networking within the bank;
• Assist with third party supplier information and cyber security risk assessments and assurance;
• Build and maintain external stakeholder relationships to support supply chain cyber risk management;
• Perform cyber security risk assessments on projects and changes to identify cyber security risks;
• Review cybersecurity risk treatment plans to ensure treatment of identified risks in line with requirements; 
• Contribute in the development and maintenance of cyber security policies and standards;
• Assists the cluster in the completion of cyber security risk assessments, ensuring that they are understood, captured in the risk management processes, that appropriate controls are embedded in the day-to-day operation, and remediation of non-compliance is documented and addressed;
• Report of all cluster specific information security program elements;
• Actively executes the cyber security programme elements and other information and cyber security plans developed by the business;
• Assist the cluster with identification of critical assets (“crown jewels”) and feeding that back into the business impact analysis and risk management processes;
• Work with the business to develop processes and procedures to ensure information security policies and standards are integrated; and
• Support the achievement of the business strategy, objectives and values by ensuring delivered systems, process, services and solutions are aligned.
• Share knowledge and industry trends with team and stakeholders during formal and informal interaction.
• Obtain buy-in for developing new and/or enhanced processes (e.g. operational processes) that will improve the functioning of stakeholders' businesses by highlighting benefits in support of the implementation of recommendations
• Seek opportunities to improve business processes and systems by identifying and recommending effective ways to operate and adding value to Nedbank. 

Minimum Experience Level

• At least 5 - 8 years demonstrable information security work experience
• Minimum 5 years’ experience in technical/risk-based Security roles
• IT /IS Audit experience

Essential Qualifications - NQF Level

• Senior Certificate/Grade 12/ Matric.
• Bachelor's degree in Computer Science or Management Information Systems, Software Engineering or equivalent

Preferred Certifications

• Certified Information Security Manager (CISM) or Certified in Risk and Information Systems Control (CRISC) or Certified Information Systems Auditor (CISA) or Certified Information Systems Security Professional (CISSP)

Type of Exposure

• Consulting
• Developed and Implemented Communications Strategy 
• Manage internal process 
• Managed Relationships 
• Managed Self

Technical / Professional Knowledge

• Information security risk assessment methodologies
• Good working knowledge and experience of security related technologies
• Good understanding of Third-Party Risk Management
• Administrative procedures and systems 
• Basic Data analysis 
• Governance, Risk and Controls 
• Business writing skills 
• Understanding of System Development Life Cycle (SDLC) 
• Information Security terms and definitions 

Behavioural Competencies

• Applied Learning 
• Communication 
• Collaborating 
• Customer Focus 
• Initiating Action 
• Managing Work 
• Technical/Professional Knowledge and Skills 

Closing Date: 7th, April 2022