Manager: Incident and Response Management (2745) at The South African National Roads Agency (SANRAL)

MINIMUM REQUIREMENTS:

• NQF Level 7 Bachelor’s degree, Advanced Diploma or equivalent in Information Technology
• Compulsory: Advanced certification as a Certified Incident Handler or equivalent (e.g. ECIH)
• 5 years min relevant experience
• 3 years min supervisory experience

KEY RESPONSIBILITIES:

Management:

• Leadership and Coordination: Ability to lead a cross-functional incident response team and manage high-pressure situations during incidents.
  Analytical Skills: Strong analytical skills to co-ordinate investigation of incidents, perform root cause analysis, and determine appropriate mitigation strategies.
• Communication: Excellent communication skills to convey information clearly to both technical and non-technical stakeholders, including senior leadership

Incident Response:

• Oversee and coordinate containment, eradication, and recovery phases of security incidents.
• Develop and implement incident response playbooks, ensuring SANRAL can respond quickly and effectively to different types of threats.
• Lead the incident response team during critical security incidents, managing communication between stakeholders and security team.

Incident Investigation and Response:

• Lead investigation of the root cause of security incidents, performing post-incident analyses to identify gaps and areas for improvement.
• Coordinate with forensic investigators to collect and analyse digital evidence and ensure proper chain-of-custody procedures are followed.
• Develop and maintain the SANRAL’s incident response plan (IRP), ensuring it aligns with industry standards and regulatory requirements.
• Conduct regular tabletop exercises and simulations to test the effectiveness of the incident response plan and train staff on incident response procedures.
• Work with other departments (e.g., IT, legal, compliance) to ensure that the incident response plan integrates seamlessly across the organization.
• Lead post-incident reviews to identify gaps and implement improvements in processes, technologies, and training to prevent future incidents.

Reporting:

• Prepare detailed incident reports and presentations for SANRAL’s senior management, outlining the impact, resolution, and next steps following an incident.
• Provide regular updates on incident summaries, performance metrics, threat landscape insights, and compliance status to SANRAL’s leadership