Information Security Senior Analyst at Badger Holdings (Pty) Ltd

Key Responsibilities:

Strategy, Roadmap & Investment

• Contribute to the development of Pacific's IS strategy and roadmap, drawing on control testing outcomes, assurance findings, and regulatory developments.
• Perform business-as-usual activities, along with active involvement in supporting the IS strategy and roadmap to ensure Pacific’s information security obligations are delivered across the function.

People Leadership & Function Development

• Contribute to a collaborative culture, setting a positive example and representing the team.
• Proactively develop IS knowledge and capability, engaging with development opportunities as agreed with the Head of Information Security.
• Provide guidance and mentoring to the IS Analyst, supporting their development in governance and risk practices.
• Identify and suggest improvements to IS team processes, templates, and coordination tools to support function efficiency and maturity.
• Operate effectively as part of a small, cross-functional team, bringing flexibility and breadth to support the IS function’s objectives.
• Explore and adopt AI tools to improve the efficiency and quality of your own work, and contribute ideas for broader adoption.

Governance & Framework Ownership

• Maintain the ISPF and IS Control Library, keeping policies, procedures, standards, and controls current, fit for purpose, and aligned to APRA CPS 234 and relevant industry standards, under direction from the Head of Information Security.
• Design and operationalise IS controls, overseeing transition of uplifted procedures and standards into business-as-usual (BAU) and supporting sustainable adoption.
• Facilitate the Information Security Working Group (ISWG) as a standing responsibility, coordinating with the IS Analyst on agendas, papers, and actions, and ensuring governance outcomes are delivered.
• Deliver insights and analysis to support governance reporting, board inputs, and executive decision-making.

Risk, Assurance & Compliance

• Support Pacific's compliance with APRA CPS 234, including preparing evidence to support compliance and coordinating audit and assurance activities.
• Conduct IS risk assessments including third-party risk assessments, producing findings and guiding treatment recommendations aligned to Pacific's enterprise risk framework.
• Lead IS issue and finding management, engaging control and risk owners to support remediation progress, and reviewing risk acceptances, extension requests, and closure evidence to ensure findings are resolved and appropriately governed.
• Deliver Pacific’s systemic control testing program, designing and executing control effectiveness reviews, documenting outcomes, and advancing remediation of identified gaps.
• Monitor material service providers against CPS 230 ‘Operational Risk’ on an ongoing basis, and escalating issues as required.

Security Operations & Resilience

• Participate in IS resilience activities including incident response exercises and disaster recovery tests, providing IS assurance oversight and observing control effectiveness firsthand.
• Review and document outcomes of IS resilience activities, identifying gaps, tracking remediation, and reporting findings to the Head of Information Security.

Security Awareness & Stakeholder Engagement

• Design and deliver Pacific's IS awareness program, with IS Analyst support, including targeted face-to-face sessions, ensuring the program remains current to foster a security-aware culture.
• Build and maintain trusted working relationships across the organisation and contribute to promoting a clear understanding of IS roles and responsibilities, supporting stakeholders to understand their IS obligations.
• Represent the IS function with external parties and in cross-functional forums as directed by the Head of Information Security.

Expanded Governance

• Advance the IS function's expanding governance remit beyond information security, building out additional governance domains as the function matures, for example technology governance.

Requirements

• Tertiary qualification in information technology, cybersecurity, business, or a related discipline, or equivalent professional experience.
• Foundational understanding of information security, risk, or governance concepts, gained through work experience, study, or transferable exposure in a related field.
• Strong communication and facilitation skills, with the ability to engage effectively across technical and non-technical audiences including senior stakeholders.
• Ability to manage a complex and varied workload with significant autonomy and deliver substantive outcomes to deadline.

Bonus Skills

• Demonstrated experience in an information security governance, risk, or compliance role in a regulated environment.
• Experience conducting IS risk assessments and control testing, with the ability to produce clear, risk-rated findings and treatment recommendations.
• Prior experience in the insurance, financial services, or prudentially regulated sector (for example APRA, FSCA, SARB, or equivalent).
• Experience chairing or facilitating governance committees or working groups.
• Professional certifications such as CISM, CRISC, CISSP, or ISO 27001 Lead Auditor / Implementer.