Business Information Security Officer

About this role

Nedbank is looking for a Business Information Security Officer (BISO) to work from its Sandown office in Johannesburg. The role sits in the Personal and Private Banking cluster and focuses on cyber and IT risk.

You will help the cluster put the Group IT and Cyber Risk Framework into daily practice and advise stakeholders on risks that could affect the business.

What you’ll do

• Lead the cluster’s cyber risk assessments, cyber security programmes, policies and standards, and reporting on information security.
• Act as the main link between the cluster and the office of the CISO, and represent the business on information security committees.
• Drive compliance with security policies on cluster infrastructure and help identify critical assets that need protection.
• Help assess cyber and IT risks from third-party suppliers, and support the cluster during cyber and IT incidents.
• Assess cyber and IT impacts of new business initiatives and guide teams on building security into their processes.
• Track the performance and compliance of your team, and run awareness campaigns on cyber risk for staff.

What you need

• A diploma, advanced diploma or first degree (minimum requirement).
• At least 3 years’ experience in information security or cyber security risk.
• At least 3 years’ experience in IT risk.
• At least 3 years’ experience in risk management.
• Advantageous: a degree or qualification in Information Security, Cyber Security or Information Technology.
• Advantageous: a certification such as CISM, CRISC, CISA or CISSP, or another relevant information security certification.
• Working knowledge of governance, risk and controls, relevant regulatory requirements, and information security policies and procedures.
• Understanding of TCP/IP, system development life cycles, relevant operating systems and vendor management principles.
• Useful knowledge of cloud computing, AI, emerging technologies and data analysis.

Is this job for you?

This role suits an experienced risk or security professional who likes working between business, technology and regulation. You should be comfortable explaining technical risks to non-technical managers and committees.

If you enjoy building risk-aware teams and shaping how security fits into new projects, this could be a good match.

Tips before you apply

• Have your qualification certificates and any security certifications ready to upload, with dates.
• Show your three or more years in cyber, IT and risk roles with clear examples, such as frameworks you helped implement.
• Describe times you reported risks to committees or senior managers, and the outcome of those reports.