Security Governance and Risk Lead

About the role

The Security Governance and Risk Lead leads the development, implementation, maintenance and oversight of the Group Information Security Governance and Risk Management Framework. The role ensures that all business clusters operate within approved security principles, policies, standards, risk appetite, minimum security requirements and regulatory obligations, and provides independent oversight and assurance under the organisation's Tight and Loose Security model.

Key responsibilities

• Develop, maintain and improve the Group Information Security Governance Framework, including operating models, forums, decision rights and escalation paths.
• Maintain security principles, policies, standards, procedures, control requirements and governance artefacts, and drive consistent governance across clusters and teams.
• Define and maintain the Tight and Loose Security principles, classifying mandatory controls and areas where local flexibility is allowed, and review exceptions, deviations and compensating controls.
• Own the Information Security Policy, Security Standards Framework, Cyber Security Framework and Security Risk Management Methodology, including emerging areas such as AI, cloud and cyber resilience.
• Define security risk methodologies, risk appetite measures and reporting criteria, and oversee risk governance activities and escalations.
• Provide governance direction to Information Security Officers, run thematic reviews, track corrective actions and report on compliance, risk exposure and control effectiveness.
• Keep frameworks aligned to regulatory and industry requirements such as Joint Standards 1 and 2, POPIA, NIST CSF 2.0, ISO/IEC 27001, ISO/IEC 27005, ISO/IEC 42001, COBIT, CIS Controls and cyber resilience expectations.

Required profile

• Tertiary qualification in Information Security, Cybersecurity, IT, Risk Management, Governance, Audit or a related discipline (NQF Level 9, Masters).
• 8-10 years of experience in information security, governance, risk management, cyber resilience or related control functions.
• 3+ years in a management role.
• Proven experience building enterprise-wide security governance frameworks, policies, standards, control libraries and risk methodologies.
• Experience in financial services or another highly regulated environment, engaging regulators, risk committees, audit teams and executives.

Required skills

• Strong working knowledge of information security governance, technology risk, control design, assurance and regulatory obligations.
• Preferred certifications: CISSP, CISM, CRISC, CGEIT; advantageous: ISO/IEC 27001 Lead Auditor, COBIT, ISO/IEC 42001 Lead Implementer, CRMA, CISA.
• Excellent leadership, stakeholder management, analytical, written communication, facilitation, negotiation and problem-solving skills.