Head: IT Security

Purpose of the Job

• The Head: IT Security is responsible for leading the bank's cyber security, information security, cryptography, security engineering and security operations capability to protect customer information, payment systems, card environments, digital channels, banking platforms and South African Social Security Agency payment services. Define and manage security strategies, standards, controls, monitoring practices and cyber resilience plans to reduce the likelihood and impact of cyber threats, ransomware, insider threats, unauthorised access, identity compromise, privilege abuse, data loss, service disruption and technology compromise. Direct specialist security teams to design, implement and monitor security controls across infrastructure, applications, networks, cloud services, Microsoft 365 services, endpoints, encryption environments, payment and card environments, third party services and user access. Provide the bank's senior information security authority, incident response leadership, cyber risk reporting and security assurance to maintain regulatory compliance, operational resilience, audit readiness and public confidence in the bank.

Job Responsibilities

Cyber and Information Security Strategy

• Define the bank's cyber and information security strategy to protect critical technology services, customer information and payment environments

• Own the cyber security strategy, operating model, control roadmap and executive cyber-risk reporting for ransomware, identity compromise, payment-system threats, insider threats and data leakage risk

• Set security principles, standards and control requirements to align security practices with risk appetite, regulatory obligations and technology governance requirements

• Develop the security operating model, control roadmap and cyber resilience plan to strengthen prevention, detection, response and recovery capability

• Review security risks, emerging threats and control maturity to prioritise security improvements and investment decision

• Report security posture, key risks and improvement progress to governance forums to support informed oversight and accountability

Senior Security Authority and Governance

• Act as the bank's senior in house information security authority to provide practical and authoritative security guidance

• Advise executive leadership, governance structures, risk forums and audit stakeholders on cyber risk, resilience and security investment priorities

• Define security policies, standards, metrics and reporting routines to support evidence-based decision making

• Assess material cyber risks, control gaps, residual risks and compensating controls to support risk treatment or risk acceptance decisions

• Promote security practices that balance risk reduction, operational continuity, customer access and business realities

Security Architecture and Engineering

• Direct security design requirements across infrastructure, applications, networks, cloud services, endpoints, databases and integration platforms to reduce technology exposure

• Review solution designs, technical changes, architecture decisions and vendor proposals to confirm alignment with approved security standards before implementation

• Guide security engineering activities to implement identity, access, network, endpoint, application and data protection controls

• Validate security configurations and control effectiveness across critical platforms to reduce misconfiguration and unauthorised access risk

• Support secure technology delivery for banking platforms, payment systems, card environments, digital channels and South African Social Security Agency payment service

Security Operations and Cyber Incident Response

• Lead security monitoring capability to detect, assess and respond to cyber threats across technology environments

• Direct investigation of security alerts, vulnerabilities, phishing attacks, privileged account compromise, suspected data loss and ransomware events to contain impact and restore secure operations

• Lead Security Operations Centre (SOC), Security Information and Event Management (SIEM), Security

• Orchestration Automation and Response (SOAR), Endpoint Detection and Response (EDR), Extended Detection and Response (XDR), threat monitoring, detection engineering, phishing response, privileged account compromise and post incident lessons learned

• Develop cyber incident response plans, escalation protocols and playbooks to support timely and coordinated response

• Coordinate incident response with technology, risk, compliance, legal, communications, vendors and executive stakeholders to manage business and regulatory impact

• Review incident lessons learned to strengthen security controls, monitoring rules, recovery readiness and response procedures

Identity Privileged Access and Data Protection

• Direct identity and access management controls to confirm that user access aligns with role requirements, segregation of duties and least privilege principles

• Oversee privileged access governance, service account control, administrative access review, access monitoring and trusted identity recovery to reduce compromise risk

• Strengthen data protection controls to reduce the risk of unauthorised disclosure, loss, alteration or misuse of customer and bank information

• Manage security testing, penetration testing and control assurance activities to identify exploitable weaknesses before they affect operations

• Track remediation actions for access, identity, data protection and security findings to improve control maturity and reduce residual risk

Cryptography and Key Management

• Define cryptography standards and key management procedures to protect payment systems, card environments, customer data and sensitive banking transactions

• Oversee Hardware Security Module administration, encryption controls and key lifecycle management to maintain secure cryptographic operations

• Monitor privileged access to cryptographic systems to reduce unauthorised access and key compromise risk

• Validate compliance with payment security, card security, encryption and key management requirements to support secure transaction processing

• Review cryptographic control exceptions and operational risks to drive corrective action and maintain trust in payment services

Cyber Resilience and Recovery Readiness

• Direct cyber resilience planning to support secure recovery from ransomware, destructive attacks, data compromise and service disruption

• Review backup protection, recovery validation, clean restoration procedures, business integrity checks to support safe service restoration, ransomware-oriented recovery controls, backup protection, clean restoration decisionmaking and business integrity checks after cyber incidents

• Coordinate cyber recovery planning with infrastructure, cloud, application, database, operations and continuity teams to strengthen recovery readiness

• Support disaster recovery tests, cyber simulation exercises and recovery validation activities to confirm response capability and evidence readiness

• Report recovery gaps, resilience risks and remediation progress to governance forums to support informed decision making

Cloud Endpoint and Digital Security

• Direct cloud, endpoint, email, collaboration platform and digital channel security controls to protect customer facing and productivity environments

• Review cloud configuration, conditional access, mailbox security, endpoint protection and internet facing platform controls to reduce attack paths

• Coordinate security monitoring across cloud services, digital channels, card services and critical banking platforms to support risk based protection

• Track vulnerabilities, misconfigurations and control gaps across cloud and endpoint environments to support timely remediation

• Support secure adoption of new technology, outsourcing arrangements and cloud services through practical s