(1920) Cyber Security Risk Analyst - BSTD

Brief description

To drive a cyber and information security risk assessment methodology across the group that incorporates threat, risk and control assessments augmented by incident management and audit finding information.

Detailed description

The successful candidate will be responsible for the following key performance areas:

• To plan and prioritise information and cyber security risk assessments across the group.
• To collect and compile all needed business area function, process and technical risk information to appropriately scope and plan for all assessments.
• To identify the information assets across the group and rate the potential impact related to the breach of confidentiality, integrity or availability whilst integrating with the business continuity impact rating process as far as possible.
• To integrate with the threat assessment process by working with the Threat Analyst to ensure an appropriate threat landscape for use in the business risk process.
• To assist the threat analyst in identifying and rating vulnerabilities and controls related to threats.
• To identify applicable risks and deriving the residual likelihood of success and business impact rating through facilitating discussion with the subject matter experts and applicable business areas.
• To maintain and report on the SARB Risk Universe through thorough, concise and reliable risk assessment reports, including risk mitigation plans for departments.
• To stay abreast of theoretical and applied developments in the field of information security risk management and analyse the implications of these changes for the work of the department and make specific proposals on how these developments might be applied to improve current practices.
• To engage with stakeholders across the SARB group at different levels of seniority, displaying the ability to solicit information as well as convey and explain information fluently.

Job requirements

To be considered for this position, candidates must be in possession of:

• minimum of a Bachelor Degree (NQF 7) in Security/Information Technology/ OR equivalent
• a minimum of 5-7 years of experience in an Information Technology environment, of which 2 years within an Security Risk environment

The following would be an added advantage

• An industry related Security Certification would be an added advantage (e.g. CRISC, CISM, CISA, CISSP)

Additional requirements include

• Knowledge and experience using the ISF Risk Management Framework
• Leading information security best practice
• Relevant Legislation
• Information Risk Trends
• Service & Stakeholder focus
• Effective Communication
• Impact & influence Drive for results
• Learning Focus
• Problem Solving and Analysis
• Teamwork
• Planning & organising
• Attention to detail

In line with the SARB’s commitment to diversifying its workforce, preference will be given to suitable candidates from designated groups. People with disabilities are welcome to apply.

The SARB offers remuneration and benefits commensurate with the level of the position and in line with the market. The level at which the successful applicant will be appointed will depend on his/her competence and experience.