Group Cyber Security Manager

About this role

Clicks Group is looking for a Group Cyber Security Manager based in Cape Town. The role leads cyber and information security across a multi-brand group that includes retail, pharmacy, distribution, digital and cloud environments. You will report to the Executive for Cyber Security and Governance.

What you’ll do

• Build and run the group’s cyber security strategy and multi-year roadmap, based on business priorities, threats and regulatory needs.
• Report cyber risk, control effectiveness and incidents to executive management each month, using dashboards and key risk indicators.
• Lead incident response, including ransomware, phishing and AI-enabled fraud, and coordinate regulatory notifications with Group Legal.
• Oversee vulnerability management, risk assessments and the penetration testing programme.
• Manage the IT security budget, licensing, renewals and vendor relationships across group entities.
• Lead the Cyber Security Lead and Information Security Lead, and their teams, including recruitment and performance management.
• Own identity and access governance, data security controls and the annual PCI DSS compliance programme.
• Review supplier and AI solution risks before they go live, and set security requirements for enterprise AI use.

What you need

• A degree or diploma in Information Technology, Systems Engineering, Computer Science or a relevant equivalent.
• CISSP or CISM certification, or an equivalent.
• At least 7 years of IT experience with a degree, or 8 years with a diploma. This must include at least 5 years of hands-on cyber or information security work and 3 years or more managing technical security teams and team leads.
• Strong knowledge of enterprise cyber security systems and architecture.
• Experience running vulnerability management and patch remediation with clear SLAs.
• Hands-on skills in several of: EDR/XDR, SIEM/MDR, privileged access management, Active Directory and Entra ID, Microsoft 365 security, firewalls and VPNs, PKI, and cloud and web application security.
• Practical incident response, log analysis, threat hunting and forensic evidence handling experience.
• Experience with NIST CSF, ISO/IEC 27001, CIS Controls and PCI DSS, including audit preparation.
• Experience managing managed security service providers and budgets in a multi-entity group.
• Working knowledge of AI security frameworks such as the OWASP Top 10 for LLM Applications, NIST AI RMF and ISO/IEC 42001.
• Knowledge of POPIA and the Cybercrimes Act, including breach notification duties.
• Advantageous: a relevant hands-on technical security certification, or a cloud security certification such as CCSP.

Is this job for you?

This role suits an experienced security leader who can also get hands-on with complex investigations. You should be comfortable explaining technical risk to executives and building strong teams. If you have led security across several businesses, this could be a strong fit.

Tips before you apply

• Have your CISSP or CISM certificate, degree or diploma, and reference letters ready to upload.
• Show your years of hands-on security work and team leadership separately on your CV, with dates and team sizes.
• Give examples of incidents you led or budgets you managed, with the outcome and the business impact.

|