Cybersecurity Risk & Operations Lead

Core; Gauteng; Presencial; ZAR 1 000 000 - 1 700 000; Tempo integral

Resumo da oferta

Core Group is seeking a senior Cybersecurity Risk & Operations Lead to strengthen our cybersecurity capability across the Group. This Johannesburg-based role drives the day-to-day cybersecurity operating rhythm and collaborates with IT leadership, Infrastructure, Retail, HR, Legal/Privacy and external partners.

You will own security risk across endpoints, cloud services, networks, applications and stores, and lead incident response, monitoring and vulnerability programs while raising security

Qualificações

• Senior cybersecurity leadership with hands-on delivery.
• Experience across endpoints, servers, cloud, networks, stores.
• Proven ability to drive remediation and governance.
• Strong incident response and forensic coordination.

Responsabilidades

• Own operational cybersecurity risk across assets and tech environments.
• Manage SOC monitoring, alerts quality, and escalation processes.
• Coordinate incident response with stakeholders and partners.
• Lead vulnerability management and security testing.
• Define minimum cybersecurity expectations for third parties.
• Develop incident-response playbooks and run simulations.

Conhecimentos

Cybersecurity leadership

Incident response coordination

SOC operations

Threat monitoring

Azure and M365 security

Vulnerability management

Formação académica

Relevant degree

CISSP, CISM, CRISC, GIAC advantageous

Ferramentas

EDR/XDR

SIEM

Microsoft Defender

Microsoft Sentinel

Nessus

Descrição da oferta de emprego

Core Group represents some of the world’s most recognised technology brands across Sub-Saharan Africa. Our businesses span retail, distribution, ecommerce, technology and customer services, operating in a fast-moving environment where technology, customer experience and operational resilience are critical.

Cybersecurity Risk & Operations Lead

We are looking for an experienced Cybersecurity Risk & Operations Lead to strengthen our cybersecurity capability across the Group.

About the Role

This is a senior, hands-on cybersecurity leadership role responsible for driving the day-to-day cybersecurity operating rhythm across Core Group.

You will work across our retail, distribution and corporate environments to identify cyber risk, improve security visibility, drive remediation, coordinate incidents and strengthen security awareness across the business.

This is not a desk-only governance role. We are looking for someone who is comfortable getting close to the technology and the business — reviewing controls, challenging gaps, engaging with employees, coordinating security partners and making sure identified risks are followed through to resolution.

The role is Johannesburg-based and will work closely with our Head of Information Security, and CIO/IT leadership, Infrastructure, Applications, Retail, HR, Legal/Privacy and external cybersecurity partners.

What You’ll Be Responsible For

Cybersecurity Risk & Operations

• Take ownership of operational cybersecurity risk across endpoints, servers, cloud services, networks, applications, stores and other relevant technology environments.

• Maintain a clear view of the organisation’s assets, controls and security monitoring coverage.

• Identify security blind spots and ensure appropriate telemetry and log sources are integrated into the SOC/SIEM environment.

• Drive the remediation of security weaknesses, vulnerabilities and control gaps within agreed timelines.

• Conduct regular security control reviews across Microsoft Azure, Microsoft 365, networks, firewalls, privileged access, remote access and other key technology environments.

Security Monitoring & SOC Management

• Lead the day-to-day relationship with our external Security Operations Centre.

• Review the quality of alerts, escalation processes and security monitoring coverage.

• Ensure critical systems and log sources are appropriately onboarded and monitored.

• Challenge false positives, monitoring gaps and ineffective escalation processes.

• Ensure security alerts result in clear ownership and timely action.

Incident Response & Readiness

• Act as the on-site cybersecurity incident coordinator during significant security events.

• Bring together the appropriate technical, operational and leadership stakeholders during an incident.

• Support business and technical decision-making by clearly communicating risks, impact and available options.

• Work closely with specialist forensic and incident-response partners where required.

• Develop and maintain practical incident-response playbooks.

• Coordinate regular simulations and tabletop exercises covering scenarios such as ransomware, data breaches, credential compromise and major service disruptions.

• Ensure lessons from incidents are translated into improved controls and processes.

Vulnerability Management & Security Testing

• Drive the organisation’s vulnerability management programme.

• Coordinate security assessments, penetration testing and red-team exercises across infrastructure, applications, websites, endpoints, stores and relevant physical or technology interfaces.

• Ensure findings are appropriately prioritised, assigned and remediated.

• Track recurring findings and challenge areas where risks remain unresolved.

Third-Party Cyber Risk

• Define and maintain minimum cybersecurity expectations for critical suppliers and technology partners.

• Assess cybersecurity risk across material third parties.

• Review privileged and vendor access into Core Group environments.

• Track remediation plans and periodically reassess higher-risk suppliers.

Insider Threat & Investigative Support

• Partner with the Chief Security Officer on technical analysis relating to potential insider-threat, fraud or security investigations.

• Analyse unusual access patterns, behaviours and security events.

• Preserve and retrieve relevant logs and technical evidence where required.

• Support investigations from a cybersecurity perspective while maintaining appropriate boundaries between cybersecurity, HR and formal investigative responsibilities.

Security Awareness & Culture

• Lead a practical and visible cybersecurity awareness programme across the organisation.

• Coordinate phishing and social-engineering simulations.

• Deliver targeted awareness campaigns, workshops and interventions.

• Engage directly with employees and operational teams to reinforce secure behaviours.

• Help build a culture where cybersecurity is understood as a shared business responsibility.

Reporting & Leadership

• Produce clear and concise reporting on cybersecurity risks, incidents, vulnerabilities, monitoring coverage, third-party exposure and remediation progress.

• Provide executives with meaningful trends, material risks, overdue actions and decisions requiring escalation.

• Provide day-to-day functional leadership and coaching to the Cybersecurity Engineer / Analyst.

• Work closely with the Head of Information Security to continuously strengthen the Group’s overall cybersecurity capability.

What We’re Looking For

You will ideally bring 8–10+ years of cybersecurity experience, including strong exposure to operational security and leadership responsibilities.

You should have:

• Strong practical cybersecurity experience across enterprise infrastructure, cloud and endpoint environments.

• Experience with EDR/XDR, SIEM, SOC operations, vulnerability management and security monitoring platforms.

• Good working knowledge of Microsoft Azure and Microsoft 365 security controls.

• Strong understanding of identity management, privileged access, network segmentation and firewall principles.

• Experience coordinating cybersecurity incidents and working with forensic or incident-response specialists.

• Experience managing penetration testing, red-team engagements or similar security assessments.

• A solid understanding of third-party cybersecurity risk and supplier assurance.

• The ability to interpret logs, security alerts and anomalous behaviour through an attacker or insider‑threat lens.

• Strong written reporting, stakeholder management and executive communication skills.

Qualifications & Certifications

• Relevant degree

• CISSP, CISM, CRISC, GIAC or equivalent are advantageous.

• Strong practical experience and demonstrated cybersecurity capability

• Exposure to platforms such as Microsoft Defender, Microsoft Sentinel, Tenable, Nessus or comparable technologies would be beneficial.

The Type of Person Who Will Thrive in This Role

We are looking for someone who is:

• Hands‑on and proactive — you actively look for risk rather than waiting for a ticket, alert or audit finding.

• Visible in the business — you are comfortable engaging employees, walking operational environments and constructively challenging unsafe practices.

• Commercially pragmatic — you understand that cybersecurity decisions need to balance risk with customer experience, operations and revenue.

• A strong communicator — you can turn complex technical information into clear business decisions.

• High in integrity and discretion — particularly when dealing with sensitive employee, fraud or security information.

• A coach and change-driver — someone who can build cybersecurity capability and culture, not simply administer tools.