Specialist - Technology Security - Cyber Secure by Design at Vodacom

Role Purpose

• The primary purpose of the role is to work within a team of Secure by Design specialists, in collaboration with the Privacy and Business Risk Teams to Perform Secure by Design Assessments against Vodacom policies and standards. In performing this role you will
• Identify potential cyber security risks for new products, services and operations and identify controls to minimise, mitigate or remove those privacy and security risks;
• Review Design and implementation of the identified controls to ensure they are built into the product (at Design & Build stages); 
• Provide assurance that privacy and security controls have been implemented before the product goes “live” and product complies with Vodacom/Vodafone Security requirements and applicable laws (at Test & Go-Live stages); 
• 4.    Assess security and privacy risks arising from changes to existing live products that impact the processing of personal data (In-Life); and
• 5.    Ensuring security and privacy risks are addressed when decommissioning these products (Decommissioning).

Your Responsibilities will include:

• Provide technology security assurance, guidance and support to high profile projects,   
• Ensure security is embedded in IT System and Network Infrastructure (Mobile, IS and Enterprise) across the Vodacom Group
• Defining, implementing, and efficiently maintaining technology security controls and requirements 
• Ensure timely delivery of technology security assurance and support for projects, products and services.
• Ensure compliance with Legal and Regulatory requirements 
• Support Technology Security awareness programs and educational efforts within the business unit to which you are asssigned
• Provide accurate and timely reporting of technology security risks identified during secure by design assessments, project engagement and propose remediation and mitigation options in line with policy and good practice

The ideal candidate for this role will have:

• 3 year Technical Diploma/Degree in Information Security, Computer Science or Engineering
• An industry certification. The CISSP is strongly preferred, however OSCP, CISM, CISA or other relevant certifications will be considered.
• Minimum of 3-5 years of experience in Tech Security role 
• Knowledge of common information technology management / compliance frameworks such as ISO/IEC 27001, NIST CSF, ISF, PCI DSS, OWASP, SANS etc.
• A deep understanding of Technology Security risks and mitigating solutions
• A diverse security background with knowledge in several areas including: Security Assessment and Testing; Software Development Security; Security Governance and Risk Management; Security Architecture and Engineering; Communication and Network Security; Identity and Access Management; Security Operations; Asset Security.   Specialist experience in Either DevSecOps, Application Security, or Offensive Security will be an added advantage. 
• Knowledge of operating systems such as Windows and Linux and how to secure them
• Knowledge of and/ or experience  in creating and managing DevSecOps pipelines practicing CSA, SAST, DAST, and Security as Code will be an added advantage
• Be well-versed in at least one of the programming languages like Java, PHP, Python, Ruby, and Perl so as to collaborate competently with software engineering teams within the organization to identify and implement opportunities for improvement and automation in the CI/CD pipeline. 
• Knowledge of Cloud and container technologies such as AWS/GCP/Azure, Docker, Kubernetes, and how to implement developer tools such as GitHub and Dependency management will be an added advantage.