Vacancies at Sasria

Job Advert Summary    

• To actively protect the organisations information technology assets and infrastructure from external or internal threats and ensuring compliance with statutory and regulatory requirements regarding information security and privacy. Also, to ensure security controls are implemented and managed across the organisation and to improve the overall security posture while maintaining the integrity of the Sasria brand.

Minimum Requirements    

Qualifications

• Information Technology (IT) related bachelor’s degree/Diploma as recognized by SAQA.
• COBIT Mandatory
• Any (1) of the IT security certifications is mandatory 
• e.g: 
• CompTIA Security
• CISCO certified
• Fortinet certified
• CISSP

Experience

• 6 years+ of Information and Technology security experience with advanced knowledge of the following technology environments: DarktraceTechnology, Fortinet Firewalls Zscaler Technology, Mimecast, Crowd strike and familiarity with industry SIEM solutions

Duties and Responsibilities    

• Not limited to;

Cybersecurity program 

• Understand Sasria’s strategy and the cybersecurity implications to enable digital trust within Sasria’s operations and platforms.
• Design, configure, deploy, and maintain security controls to safeguard Sasria’s infrastructure.
• Actively protect the organization’s information technology assets and infrastructure from external or internal threats and ensure compliance with statutory and regulatory requirements regarding information access, security, and privacy.
• Analyse problems, and recommend solutions, products, and technologies to meet business security and information security objectives.
• Data Protection and Encryption
• Understand organizational information data flow and maintain an inventory of data to ensure sensitive information is identified and protected adequately.
• Understand data classification framework and implement controls as per sensitivity levels.
• Ensure protection of data with advanced data encryption, data masking, or tokenization, to protect data across applications, transactions, storage, and big data platforms, on endpoints, servers, databases, and cloud environments.
• Develop or install software, such as data encryption programs for data at rest, in transit, and in use such as SSL certificates to protect sensitive information.

Network, Web and Endpoint Security and Monitoring 

• Build, maintain and upgrade security technology, such as firewalls, web application firewalls; network access controls; web security controls; endpoint security controls for the safe use of computer networks, and the transmission and retrieval of information during business operations.
• Maintain the malware and destructive activities policy rules across security platforms to ensure business continuity while security is maintained.
• Coordinate monitoring of networks or systems for security breaches or intrusions across Cloud and On-premises platforms.
• Ensure endpoint security controls have covered the whole Sasria landscape and remain effective in identifying and mitigating threats in line with the in-depth layered defense approach.

Threat and Vulnerability management

• Lead threat landscape assessment and situational Cyber-attack Vulnerability awareness through an understanding of the vulnerability Detection, Management management program.
• Ensure vulnerability assessments and penetration tests are performed periodically.
• Analyse, and interpret vulnerability results and facilitate Protection, and Response Maturity levels remediation of identified vulnerabilities in conjunction with other IT departments, and business applications owners.

Physical security

• Support facilities with the implementation of physical security measures designed to deny unauthorized access to Sasria premises.
• Ensure robust and fit-for-purpose access controls, surveillance cameras, and intrusion systems.
• Ensure advanced controls are in place for high-risk areas such as data centers and computer storage areas. 

Disaster Recovery and Business Continuity 

• Support the development of disaster response and recovery strategies within Sasria.
• Ensure seamless transition between Sasria and the disaster recovery site during security breaches or other business interruptions.
• Troubleshoot security and network problems to maintain a fit-for-purpose DR site and business continuity - plans. 

Incident Response and Third Line Support

• Provide second-line support to users with any Information Security related queries within the SLA period.
• Provide technical support to computer users for installation and use of security products.
• Oversee and provide advanced support on open issues (e.g.,customer logged tickets, incidents, projects, etc.)
• Assist in incident response for any breaches, intrusions, or theft.

Ad hoc

• Continuously develop information security standards and best practices to respond to the changing environment.
• Follow the Procurement processes to purchase and identify the right service providers for security services.
• Oversee Third-party service delivery in line with defined service level agreements.

go to method of application »

Job Advert Summary    

• The role is required to assist in the development of a security architecture capability that will continue to mature to address the complex security problems in systems, people and processes including those that emerge in digital business transformation. It incorporates planning and designing Sasria Processes, Information and Technology components to interact harmoniously while aligned with business requirements to maintain a state of “managed-security-related risk”. Agility in learning core skills and emerging skills based on unique circumstances within the organisation.

Minimum Requirements    

Qualifications

• Minimum Qualifications: National Diploma in IT /Bachelor or Relevant equivalent
• COBIT preferred
• One of the following Cybersecurity certification is mandatory: ISO 27001/ CRISC/ CISSP/ CEH

Experience

• Minimum of 8 years cybersecurity related experience.
• Experience in security architecture methodologies, tools and enablers.
• Hands-on experience with implementation and monitoring of various IT Security solutions.

Duties and Responsibilities    

• Not limited to;

Cybersecurity Architecture

• Design and maintain a secure architecture for both cloud and on-premises environments, ensuring alignment with enterprise IT strategy and cybersecurity frameworks.
• Conduct architecture reviews and threat modeling exercises to proactively identify design-level risks and recommend mitigations.
• Develop security reference architectures and patterns for infrastructure, applications, data, and identity management, incorporating zero trust principles and secure-by-design approaches.
• Ensure architectural compliance with industry standards and regulatory frameworks including POPIA ISO/IEC 27001, NIST SP 800-53, IT Joint Standards.
• Improve the security methods and practices that influence the architecture and design of Sasria processes and technology deployments. 

IT Security Operations

• Collaborate with Security Operations to ensure architectural alignment in monitoring, threat detection, and incident response capabilities.
• Provide strategic input into the selection and deployment of SIEM, SOAR, DLP, EDR, and other critical tools to enhance the organization's security posture.
• Oversee the technical validation of security controls and ensure their effective implementation throughout the solution lifecycle.
• Analyze security issues and recommend appropriate solutions, technologies, and best practices aligned to business needs.
• Contribute to the secure configuration of systems and infrastructure in alignment with security baselines and hardening guides (e.g., CIS Benchmarks).
• Ensure adherence to approved ICT governance principles and compliance with applicable policies.

Change and Configuration Management

• Act as a security design authority in change advisory meetings (CAM) processes, evaluating risks associated with proposed changes.
• Provide architectural oversight for security configuration changes and remediation plans resulting from audits, risk assessments, or penetration tests.

Governance, Risk, and Compliance 

• Develop and maintain cybersecurity architecture standards, principles, and policies in collaboration with GRC and Enterprise Enablement and Architecture (EEA) teams.
• Ensure architectural compliance with enterprise risk management processes, supporting enterprise risk appetite measures.
• Support the organization in responding to audits and regulatory reviews, providing architectural evidence of control implementation.
• Contribute to the planning and compliance monitoring through the CRMP process.
• Ensure compliance with GOI and IT Joint Standards.

Reporting

• Contribute to the development of strategic cybersecurity dashboards and reports that reflect architectural coverage, maturity, and roadmap progress.
• Track alignment of architectural decisions with key cybersecurity KPIs and organizational goals. 

Processes and Continuous Improvement

• Continuously evaluate emerging technologies (e.g., AI/ML in cybersecurity, container security, SASE, XDR) and incorporate innovations into the architectural roadmap.
• Stay informed of emerging cybersecurity threats, trends, and technologies, particularly in the cloud security space.
• Promote the adoption of up-to-date cybersecurity frameworks to enhance overall risk mitigation.
• Champion cybersecurity innovation by participating in forums and research activities to evolve the organization’s security capabilities.
• Regularly update architectural documentation and frameworks to reflect changes in technology and threat landscapes.
• Stakeholder Engagement and Collaboration 
• Work closely with Enterprise Enablement and Architecture, IT infrastructure, Project Office, and application teams to embed security into solution design.
• Influence and guide internal stakeholders on best practices in cybersecurity architecture and risk-informed decision-making.
• Provide architectural support and guidance to security-related projects, incident response efforts, and solution delivery teams.
• Act as an escalation point for complex security architecture queries or solution reviews.

Ad hoc

• Assist in the execution of ad hoc requests and special tasks as required by team members or leadership.
• Assist in special projects or ad hoc tasks requiring architectural expertise, including post-incident reviews or risk assessments.