JOB DESCRIPTION

SECURITY AND COMPLIANCE MANAGER
Reporting to:Chief Information Officer
Employment type:Permanent | In -office

Location: Tygervalley, Cape Town

Hours: After hours and standby when operationally required

Apply:

About our client

Our client is a growing, manufacturing automation technology-enabled business with a broad applications and infrastructure environment, supported by internal technical teams and external technology partners. As its technology landscape evolves, maintaining a robust information security, risk and regulatory compliance framework is essential to protecting business operations, information and customers.

The opportunity

Our client is seeking an experienced Security and Compliance Manager to establish, coordinate and oversee its information security and compliance posture across the technology environment.

This is a hands-on security governance and assurance role. You will own the security framework, including policies, standards, risk registers and assurance programmes, while working closely with internal technology teams and external providers to ensure that agreed controls are implemented and maintained.

You will also act as the escalation point for security incidents and information breaches, coordinating the response and advising the CIO.

Key responsibilities

• Establish, maintain and continuously improve the organisation's information security policies, standards, frameworks and risk register.

• Develop and oversee a structured security assurance programme, including control testing, reviews and reporting.

• Monitor compliance with relevant legislation, regulatory requirements and recognised information security frameworks.

• Coordinate security audits, assessments, remediation plans and the closure of audit findings.

• Provide security governance and assurance across applications, infrastructure, networking, cloud environments and technology delivery.

• Work with technical teams to assess vulnerabilities, penetration-test findings and security risks, and track remediation.

• Oversee security requirements within software development, application delivery, cloud environments and DevSecOps processes.

• Establish and monitor identity and access management standards, including MFA, privileged access and access reviews.

• Conduct third-party and vendor security assessments, including due diligence and review of contractual security requirements.

• Maintain the organisation's security incident response and information breach management processes.

• Lead the coordination of security incidents, including classification, escalation, containment, evidence preservation, stakeholder communication and post-incident reviews.

• Work with the Information Officer on applicable POPIA breach notification requirements.

• Coordinate incident response exercises and tabletop simulations.

• Promote security awareness and a culture of responsible information handling across the business.

• Provide clear, practical security advice and reporting to the CIO and relevant stakeholders.

• Participate in after-hours escalation and standby arrangements for significant security incidents and information breaches.

Minimum requirements

• Grade 12.

• Bachelor's degree in Information Technology, Computer Science, Information Security or a related discipline.

• At least 7--10 years' IT experience, including a minimum of five years in information security, IT risk or compliance.

• At least three years' experience leading or coordinating security activities across multiple IT teams, preferably without direct line-management authority.

• Recognised security certification such as CISSP, CISM or ISO 27001 Lead Implementer / Lead Auditor. CompTIA Security+ is the stated minimum certification requirement.

• ITIL V4 Foundation.

• Demonstrable experience implementing or overseeing security frameworks such as ISO 27001, NIST CSF or CIS Controls.

• Practical knowledge of POPIA compliance and audit requirements.

• Experience assessing security across hybrid AWS / Azure environments, Microsoft 365, on-premises networks and endpoints.

• Experience managing third-party security risk and technology vendor assurance.

Advantageous experience and qualifications

• CISA or CRISC certification.

• AWS Security Specialty or Microsoft Azure security certification such as AZ-500 or SC-100.

• Experience in retail, e-commerce or payment environments.

• Exposure to PCI DSS requirements where cardholder data is within scope.

• Experience working across multiple jurisdictions**.**

Technical knowledge

A strong understanding of:

• ISO 27001 and ISO 27002, NIST Cybersecurity Framework 2.0, CIS Controls v8 and COBIT.

• POPIA, PAIA, the Cybercrimes Act, ECTA and Consumer Protection Act, together with relevant requirements in other operating jurisdictions.

• Security risk management, control design, assurance and audit methodologies.

• Cloud security, DevSecOps and secure software development practices.

• Network, wireless and endpoint security.

• Identity and access management, including Microsoft Entra ID, MFA and privileged access management.

• Application security, OWASP, secure SDLC, SAST, DAST and API security.

• SIEM, vulnerability management and incident response.

• Third-party security assessments, SOC 2 and ISO assurance documentation.

• ITIL V4 service management principles.

Key skills and competencies

• Information security governance and framework management.

• IT risk assessment and regulatory compliance.

• Security audits, control testing and remediation tracking.

• Security incident and information breach management.

• Cloud, application, network and endpoint security assurance.

• Identity and access management.

• Vendor and third-party risk management.

• Policy development and security standards.

• Security awareness and organisational change.

• Executive reporting and stakeholder engagement.

Personal attributes

The successful candidate will demonstrate high levels of integrity, discretion and professional judgement. You will be analytical, detail-oriented and methodical, with the ability to remain composed when managing sensitive or high-pressure incidents.

Strong communication and relationship-building skills are essential. You will need to influence stakeholders, challenge practices constructively, resolve disagreements and translate technical security risks into clear business implications.

This role will suit someone who can balance firm governance and accountability with a practical, collaborative approach to working across technology teams.