Senior Security Analyst

About the role

Ozow, a leading South African fintech, is looking for a Senior Security Analyst to lead and evolve its security programme. Reporting to the Infrastructure Manager, you will shape the security roadmap, protect critical systems and guide senior leadership on risk.

Key responsibilities

• Develop and maintain the security roadmap in partnership with the Infrastructure Manager, prioritising initiatives based on risk and business impact.
• Define and enforce security standards, baselines and testing methodologies across teams.
• Lead hands‑on penetration testing, red‑team exercises and adversary simulations across infrastructure, cloud, applications, APIs and endpoints.
• Manage security tooling such as SIEM, EDR, vulnerability scanners, WAF and IDS/IPS, including selection, configuration and optimisation.
• Own the end‑to‑end vulnerability management lifecycle, set remediation SLAs and drive closure across cloud, application and CI/CD pipelines.
• Act as technical lead during security incidents, coordinate response, conduct post‑incident reviews and implement permanent controls.
• Design secure architecture principles, enforce configuration baselines (e.g., CIS Benchmarks) and embed security into DevSecOps pipelines.
• Lead technical workstreams for audits (PCI DSS, ISO 27001, POPIA) and maintain internal security policies.

Required profile

• Bachelor’s degree in Computer Science, Information Security or equivalent practical experience.
• At least 8 years of experience in cybersecurity, offensive security, security engineering or security operations, with a proven record of owning a security programme.
• Strong ability to influence stakeholders without direct authority and communicate technical risks to executives and auditors.
• Experience working in regulated environments and handling due‑diligence security questionnaires.

Required skills

• Penetration testing and red‑team/adversary simulation.
• Vulnerability management at scale.
• Security frameworks: ISO 27001, NIST, PCI DSS, CIS Benchmarks, OWASP.
• Security tooling: SIEM, EDR, vulnerability scanners, WAF, IDS/IPS.
• Cloud security (AWS) and scripting/automation.
• DevSecOps integration and CI/CD pipeline security.
• Relevant certifications (OSCP, OSCE, CRTO, CREST, CISSP, AWS Security Specialty) – preferred.