Cybersecurity Risk & Operations Lead

Core; Johannesburg; On-site; ZAR 1,200,000 - 2,000,000; Full time

Job summary

Core Group is seeking a Cybersecurity Risk & Operations Lead to strengthen our security posture across Sub-Saharan Africa. This role combines hands-on technical leadership with strategic risk management in a fast-paced retail, distribution and corporate environment.

You will own operational cybersecurity risk, manage the SOC, coordinate incidents and drive remediation across Azure, EDR/XDR, and broader IT estates. Strong leadership and communication are essential.

Qualifications

• Senior cybersecurity leadership experience across large, multi-vertical environments.
• Proven ability to drive operational security, risk-based decisions and remediation timelines.
• Experience coordinating incidents with forensic/IR partners and external SOCs.

Responsibilities

• Own operational cybersecurity risk across endpoints, cloud, networks and stores.
• Oversee SOC monitoring, alert quality and escalation processes.
• Coordinate incidents, runbooks and tabletop exercises with stakeholders.
• Lead vulnerability management and third-party risk programs.
• Drive security awareness and governance across the organisation.

Skills

Leadership

Stakeholder management

Executive communication

Risk-based thinking

Education

Relevant degree

Tools

EDR/XDR

SIEM

SOC platforms

Vulnerability management tools

Microsoft Defender

Microsoft Sentinel

Job description

Core Group represents some of the world's most recognised technology brands across Sub-Saharan Africa. Our businesses span retail, distribution, ecommerce, technology and customer services, operating in a fast-moving environment where technology, customer experience and operational resilience are critical.

We are looking for an experienced Cybersecurity Risk & Operations Lead to strengthen our cybersecurity capability across the Group.

About the Role

This is a senior, hands-on cybersecurity leadership role responsible for driving the day-to-day cybersecurity operating rhythm across Core Group.

You will work across our retail, distribution and corporate environments to identify cyber risk, improve security visibility, drive remediation, coordinate incidents and strengthen security awareness across the business.

This is not a desk-only governance role. We are looking for someone who is comfortable getting close to the technology and the business - reviewing controls, challenging gaps, engaging with employees, coordinating security partners and making sure identified risks are followed through to resolution.

The role is Johannesburg-based and will work closely with our Head of Information Security, and CIO/IT leadership, Infrastructure, Applications, Retail, HR, Legal/Privacy and external cybersecurity partners.

What You’ll Be Responsible For

Cybersecurity Risk & Operations

• Take ownership of operational cybersecurity risk across endpoints, servers, cloud services, networks, applications, stores and other relevant technology environments.
• Maintain a clear view of the organisation’s assets, controls and security monitoring coverage.
• Identify security blind spots and ensure appropriate telemetry and log sources are integrated into the SOC/SIEM environment.
• Drive the remediation of security weaknesses, vulnerabilities and control gaps within agreed timelines.
• Conduct regular security control reviews across Microsoft Azure, Microsoft 365, networks, firewalls, privileged access, remote access and other key technology environments.

Security Monitoring & SOC Management

• Lead the day-to-day relationship with our external Security Operations Centre.
• Review the quality of alerts, escalation processes and security monitoring coverage.
• Ensure critical systems and log sources are appropriately onboarded and monitored.
• Challenge false positives, monitoring gaps and ineffective escalation processes.
• Ensure security alerts result in clear ownership and timely action.

Incident Response & Readiness

• Act as the on-site cybersecurity incident coordinator during significant security events.
• Bring together the appropriate technical, operational and leadership stakeholders during an incident.
• Support business and technical decision-making by clearly communicating risks, impact and available options.
• Work closely with specialist forensic and incident-response partners where required.
• Develop and maintain practical incident-response playbooks.
• Coordinate regular simulations and tabletop exercises covering scenarios such as ransomware, data breaches, credential compromise and major service disruptions.
• Ensure lessons from incidents are translated into improved controls and processes.

Vulnerability Management & Security Testing

• Drive the organisation’s vulnerability management programme.
• Coordinate security assessments, penetration testing and red-team exercises across infrastructure, applications, websites, endpoints, stores and relevant physical or technology interfaces.
• Ensure findings are appropriately prioritised, assigned and remediated.
• Track recurring findings and challenge areas where risks remain unresolved.

Third-Party Cyber Risk

• Define and maintain minimum cybersecurity expectations for critical suppliers and technology partners.
• Assess cybersecurity risk across material third parties.
• Review privileged and vendor access into Core Group environments.
• Track remediation plans and periodically reassess higher-risk suppliers.

Insider Threat & Investigative Support

• Partner with the Chief Security Officer on technical analysis relating to potential insider-threat, fraud or security investigations.
• Analyse unusual access patterns, behaviours and security events.
• Preserve and retrieve relevant logs and technical evidence where required.
• Support investigations from a cybersecurity perspective while maintaining appropriate boundaries between cybersecurity, HR and formal investigative responsibilities.

Security Awareness & Culture

• Lead a practical and visible cybersecurity awareness programme across the organisation.
• Coordinate phishing and social-engineering simulations.
• Deliver targeted awareness campaigns, workshops and interventions.
• Engage directly with employees and operational teams to reinforce secure behaviours.
• Help build a culture where cybersecurity is understood as a shared business responsibility.

Reporting & Leadership

• Produce clear and concise reporting on cybersecurity risks, incidents, vulnerabilities, monitoring coverage, third-party exposure and remediation progress.
• Provide executives with meaningful trends, material risks, overdue actions and decisions requiring escalation.
• Provide day-to-day functional leadership and coaching to the Cybersecurity Engineer / Analyst.
• Work closely with the Head of Information Security to continuously strengthen the Group's overall cybersecurity capability.

What We’re Looking For

You will ideally bring 8-10+ years of cybersecurity experience, including strong exposure to operational security and leadership responsibilities.

You should have:

• Strong practical cybersecurity experience across enterprise infrastructure, cloud and endpoint environments.
• Experience with EDR/XDR, SIEM, SOC operations, vulnerability management and security monitoring platforms.
• Good working knowledge of Microsoft Azure and Microsoft 365 security controls.
• Strong understanding of identity management, privileged access, network segmentation and firewall principles.
• Experience coordinating cybersecurity incidents and working with forensic or incident-response specialists.
• Experience managing penetration testing, red-team engagements or similar security assessments.
• A solid understanding of third-party cybersecurity risk and supplier assurance.
• The ability to interpret logs, security alerts and anomalous behaviour through an attacker or insider-threat lens.
• Strong written reporting, stakeholder management and executive communication skills.

Qualifications & Certifications

• Relevant degree
• CISSP, CISM, CRISC, GIAC or equivalent are advantageous.
• Strong practical experience and demonstrated cybersecurity capability
• Exposure to platforms such as Microsoft Defender, Microsoft Sentinel, Tenable, Nessus or comparable technologies would be beneficial.

The Type of Person Who Will Thrive in This Role

We are looking for someone who is:

• Hands-on and proactive - you actively look for risk rather than waiting for a ticket, alert or audit finding.
• Visible in the business - you are comfortable engaging employees, walking operational environments and constructively challenging unsafe practices.
• Commercially pragmatic - you understand that cybersecurity decisions need to balance risk with customer experience, operations and revenue.
• A strong communicator - you can turn complex technical information into clear business decisions.
• High in integrity and discretion - particularly when dealing with sensitive employee, fraud or security information.
• A coach and change-driver - someone who can build cybersecurity capability and culture, not simply administer tools.

9 people have applied for this job. 183 people have viewed this job.