InfoSec Governance & Policy Strategist

Sasso Consulting; Johannesburg; Hybrid; ZAR 900,000 - 1,200,000; Full time

Job summary

Sasso Consulting in Johannesburg seeks experienced IT Security Governance and Policy Specialists to develop and maintain information security governance frameworks, policies and procedures within complex enterprise IT environments.

You will ensure policies align with regulatory requirements, ISO 27001, NIST and COBIT, manage risk registers, and support audits, governance committees and awareness initiatives.

Qualifications

• Relevant diploma or degree in Information Technology or related field.
• 3–5 years in IT security governance, risk management or cybersecurity GRC.
• Experience developing or maintaining information security policies and standards.
• Familiarity with ISO/IEC 27001, NIST or COBIT and POPIA.
• Strong documentation and stakeholder engagement skills.

Responsibilities

• Develop, implement and maintain information security policies and governance frameworks.
• Ensure policies align with regulatory requirements and industry standards.
• Coordinate governance structures, reporting and assurance activities.
• Conduct risk assessments and maintain risk registers and remediation plans.
• Support audits, evidence collection and compliance documentation.
• Collaborate with multiple teams to drive policy adoption and awareness.

Skills

Information security governance

Risk management

Regulatory compliance

Policy development

GRC governance

Stakeholder engagement

Education

Bachelor's degree in IT / Cybersecurity / related

Tools

ServiceNow GRC

RSA Archer

ISMS (ISO/IEC 27001)

COBIT

OneTrust

Job description

Sasso Consulting in Johannesburg seeks experienced IT Security Governance and Policy Specialists to develop and maintain information security governance frameworks, policies and procedures within complex enterprise IT environments.

You will ensure policies align with regulatory requirements, ISO 27001, NIST and COBIT, manage risk registers, and support audits, governance committees and awareness initiatives.