Business Information Security Officer at Nedbank

Job Purpose

• To ensure that the Group IT and Cyber Risk Framework is embedded, operationalised and implemented within the business, while providing advice and guidance to mitigate business risks and ensure regulatory requirements are met.
• The BISO will support the business cluster in the implementation and execution of the Cyber Resilience Risk Management Framework, including cyber risk assessments, cyber security strategy and programmes, policies and standards, reporting of cluster-specific cyber security programme elements, and regulatory matters relating to cyber security.

Job Responsibilities

• Contribute to a culture conducive to the achievement of transformation goals (targets) and support business strategies that improve corporate image by participating in Nedbank Culture building initiatives (e.g. Surveys etc.).
• Achieve business strategy by participating and encouraging others to participate in and support corporate social responsibility initiatives.
• Foster transformation of the workplace and support Nedbank achievement of the BEE initiatives and transformation targets, by contributing to an environment where diversity is valued.
• Improve work processes, productivity and reduce costs by offering innovative ideas and input to Group Risk and/or stakeholders and through soliciting input from managers and colleagues.
• Develop risk plans that enable the implementation of the business strategy by breaking it down into targets and obtaining approval of plan from relevant strategic committees such as EXCO, ERCO, OPCOM, etc.
• Ensure compliance with regulations and prevent losses by facilitating risk management in the business and by engaging with relevant stakeholders regarding risk-related issues.
• Ensure alignment of area business processes to the Group Risk Framework by participating and providing information to Nedbank Risk Committees.
• Keep business updated on a regular basis and analyse information generated from the risk exercises by ensuring that risk monitoring exercises across the business take place and are in line with all known risks.
• Ensure business processes and systems are functioning by identifying and documenting risks.
• Track the performance and compliance of the team by allocating tasks to the team according to different risk areas.
• Ensure the business fully complies with risk standards by revising cluster risk process guidelines.
• Mitigate risks by providing the business with relevant information, guidance and advice based on regulatory standards, compliance and audit findings.
• Evaluate and analyse area audit findings and management improvement comments, by assessing whether actions will result in improvement and by making recommendations.
• Meet financial objectives by containing costs.
• Ensure improvements on identified risks by engaging with business, understanding risks and by creating action plans.
• Operationalise the Nedbank Group IT and Cyber Risk Framework by ensuring that business unit level ERCO governance structure and charters are implemented, ensuring adequate risk reports generated, risk meetings held and risk processes aligned with group.
• Build and maintain relationships with clients and service providers through attending meetings and utilising networking opportunities.
• Share information and knowledge with stakeholders, peers and team by driving awareness campaigns.
• Build relationships by reporting risk issues and by providing risk-related information to strategic committees, as per the Group Risk Framework.
• Build long-term relationships and support stakeholders in reaching business objectives by keeping abreast of and sharing industry information with stakeholders.
• Support the achievement of the business strategy, objectives and values by understanding Nedbank risk strategy and Business Unit Plan.
• Identify training courses and career progression for self through input and feedback from management.
• Ensure all personal development plan activities are completed within specified timeframe.
• Share knowledge and industry trends with team and stakeholders during formal and informal interaction.

Job Resposibilities continued

• Obtain buy-in for developing new and/or enhanced processes (e.g. operational processes) that will improve the functioning of stakeholders' businesses by highlighting benefits in support of the implementation of recommendations.
• Drive compliance to security policies and standards on cluster infrastructure.
• Primary interface between the cluster and CISO office.
• Represent business as an information security representative on various committees.
• Ensure alignment and implementation of CRRMF in cluster.
• Report of all cluster specific information security program elements.
• Work closely together with all stakeholders.
• Actively executes the cyber security programme elements and other information and cyber security plans developed by the business.
• Assist the cluster with identification of critical assets (“crown jewels”) and feeding that back into the business impact analysis and risk management processes.
• Work with the business to develop processes and procedures to ensure information security policies and standards are integrated.
• Assist with third party supplier information and cyber security risk assessments and assurance.
• Assist business with incident management related to cyber and/or IT incidents.
• Conclude cyber / IT impact assessment on new business initiatives.
• Build and maintain professional relationships by information sharing and professional networking within the bank.
• Build and maintain internal stakeholder relationships through collaboration with stakeholders and regular communication via various media.

Essential Qualifications - NQF Level

• Diploma
• Advanced Diplomas/National 1st Degrees

Preferred Qualification

• Information Security
• Cyber Security
• Information Technology

Preferred Certifications

• Certified Information Security Manager (CISM)
• Certified in Risk and Information Systems Control (CRISC)
• Certified Information Systems Auditor (CISA)
• Certified Information Systems Security Professional (CISSP)
• Relevant Information Security Certification 

Minimum Experience Level

• 3+ years' experience in Information Security Risk / Cyber Security Risk
• 3+ years' experience in Information Technology Risk
• 3+ years' experience in Risk Management
• Technical Knowledge
• Artificial Intelligence
• Blockchain
• Cryptocurrencies
• Cloud Computing
• Emerging Technologies

Technical / Professional Knowledge

• Administrative procedures and systems
• Data analysis
• Governance, Risk and Controls
• Principles of project management
• Relevant regulatory knowledge
• Relevant software and systems knowledge
• Cluster Specific Operational Knowledge
• System Development Life cycle(SDLC)
• TCP/IP
• Information Security terms and definitions
• Relevant Operating System
• Information Security policies and procedures
• Vendor Management Principles

Closing date: 29 October 2026