JOB DESCRIPTION
Strategy and Planning
- Create solutions that align enterprise security architecture frameworks and standards (e.g. SABSA, NIST 800-53, ISO 27002) with overall business and security strategy.
- Employ secure configuration management processes.
- Identify and prioritize system functions required to promote continuity and availability of critical business processes such that in the circumstance of system failure critical business functions are restored or recovered promptly.
- Design, build and implement enterprise-class security systems for a production environment
- Align standards, frameworks and security with overall business and technology strategy
- Design security architecture elements to mitigate threats as they emerge
- Identify security design gaps in existing and proposed architectures and recommend changes or enhancements
- Derive the IT Security strategy from the overall Chief Information Security Office (CISO) strategy and requirements and translates this into an operational plan for delivery for their area of responsibility
- Drive integration of Chief Information Security Office Initiatives, programs and central solutions and ensure alignment with the divisional portfolios.
- Are responsible for the adoption of centrally mandated Security Solutions and the maintenance of technical security documentation and compliance to security controls.
- Spearhead independent reviews of IT Security Controls, prioritise identified issues and assesses remediation actions for quality, considering the optimal cost-risk ratio as well the strategically optimal resolution (e.g. Information Security control evaluation and respective follow up activities).
- Solid understanding of security protocols, cryptography, authentication, authorization and cloud security.
- Good knowledge of Network security, Cloud security, Infra structure security, endpoint security, IAM etc
- Knowledge of typical security devices such as firewalls,NAC, intrusion detection systems, AV and End Point security, Web Application Firewalls, anti-spam systems, event correlation systems, etc.
- Knowledge of network technologies, Windows and Linux administration with understanding of well-known application like SAP, Service Now
- Experience in penetration testing and vulnerability management.
- Act as a trusted advisor during engagement with the stakeholders in business, demand management and suppliers / vendors to ensure that any proposed technology solution is designed with a secure-by-design philosophy.
- Ensure that all the required mechanisms are factored in to any proposed technology solution so that the solution is aligned to the security architecture, approved application landscape, policies, standards and guidelines and best practices.
- Engage with the requisite stakeholders at technology idealization or concept stage to ensure that information security risks are identified, quantified and either eradicated or mitigated successfully in the end solution design.
- Keep up to date with the latest threat and attack vectors and mechanisms for overcoming them.
Communication
- Document security requirements and controls for protecting information, systems, and technology assets.
- Define and document how the implementation of a new technology impacts the security posture of the current environment.
- Document and update as necessary all definition and architecture activities.
- Provide input on security requirements to be included in request for proposals (RFPs), statements of work (SOWs), and other procurement documents.
- Communicate current and emerging security threats to project team members.
QUALIFICATIONS ,SKILLS AND EXPERIENCE REQUIREMENTS
- University degree in Computer Science, Engineering, or related field (preferred)
- Minimum of 5-8 years of experience in Security Architecture.
- CISSP, CISA, CISM, or other relevant security related designation(s) preferred
- Certifications in CISSP-ISSAP, TOGAF, or SABSA considered an asset
- Experience in identifying gaps in existing architectures.
- Experience in designing security architectures to mitigate threats.
- Knowledge of computer networking concepts and protocols (e.g. TCP/IP, DNS) and network security methodologies.
- Planning and organizing
- Technical and analytical
- Deadline driven
- Innovative
- Teamworker
Desired Skills:
- Teamworker
- Planning & Organising
- Innovative
- Engineering
Desired Work Experience:
- 5 to 10 years Clinic & Hospital
- 5 to 10 years Technical / Business Architecture
Desired Qualification Level:
- Degree