IT Security Manager (Compliance & Risk)

Top Vitae Recruitment; Gqeberha; On-site; ZAR 900,000 - 1,300,000; Full time

Job summary

Top Vitae Recruitment is seeking an IT Security Manager to lead governance, risk management, and compliance across the organization. The role focuses on developing security policies, driving governance adoption, and partnering with stakeholders to embed security in business processes.

The role will manage risk assessments, maintain the enterprise risk register, coordinate audit activities, and lead security awareness initiatives.

Qualifications

• 5+ years of experience in information security, governance, risk management, compliance, or audit.
• Knowledge of information security principles, governance practices, and risk management processes.
• Experience coordinating audits, assessments, findings, and remediation activities.
• Experience developing and maintaining security policies, standards, procedures, and awareness programs.
• Strong written and verbal communication, and ability to influence stakeholders.

Responsibilities

• Lead security governance across the organization, developing policies and guiding adoption.
• Oversee risk management, maintain risk registers, and track remediation timelines.
• Coordinate internal and external security assessments and audit activities.
• Develop security awareness programs and provide guidance on security responsibilities.
• Conduct third-party security reviews and manage vendor security risk remediation.
• Support security program planning, reporting, and governance process improvements.

Skills

Information security governance

Risk management

Audit coordination

Policy development

Stakeholder management

Security awareness

Education

Bachelor's degree in Information Security / related

CISSP or similar certification (CISM, CRISC, CGRC, ISO 27001 Lead Implementer)

Job description

The IT Security Manager is responsible for leading and supporting information security governance, risk management, compliance, and security assurance activities across the organization.

Security Governance

• Develop, maintain, and improve information security policies, standards, procedures, and guidelines.
• Drive adoption of security governance practices across the organization.
• Partner with business and technology stakeholders to ensure security requirements are included in business processes and initiatives.
• Provide subject matter expertise on information security governance matters.

Risk Management

• Lead the identification, assessment, treatment, monitoring, and reporting of information security risks.
• Maintain and support the enterprise security risk register.
• Track remediation plans and ensure security risks are managed within approved timelines.
• Facilitate recurrent security risk assessments across business functions and technology environments.

Compliance and Audit Support

• Coordinate internal and external information security assessments and audit activities.
• Support security requirements related to contractual, regulatory, customer, and industry obligations.
• Manage audit findings, corrective action plans, evidence coordination, and remediation tracking.
• Prepare management reports and metrics related to compliance and security program effectiveness.

Security Awareness and Training

• Develop and support security awareness and training activities.
• Promote practical security behavior across the organization.
• Provide guidance to employees, management, and stakeholders on security responsibilities.

Third-Party and Vendor Security

• Support third-party security risk management activities.
• Perform security reviews of vendors, service providers, and business partners.
• Track vendor security risks and coordinate remediation where required.

Security Program Management

• Support planning and execution of security initiatives, projects, and strategic objectives.
• Measure and report on information security prog
• Identify opportunities to improve security governance processes and reduce operational friction.
• Act as a central point of coordination and escalation for governance, risk, compliance, and security assurance matters.

OUT OF SCOPE

• Security Operations Center management.
• Security incident response execution or technical investigation ownership.
• Security engineering, architecture, or tool administration.
• Endpoint detection and response platform ownership.
• Vulnerability scanning operations and patch execution.
• Identity and access management platform administration.
• Network security operations or firewall administration.

SECONDARY RESPONSIBILITIES

• Participate in strategic security projects and security improvement initiatives.
• Support business continuity and disaster recovery governance activities where required.
• Assist with security-related customer, partner, and vendor questionnaires.
• Support annual policy reviews, documentation updates, and security reporting activities.
• Research emerging security risks, regulatory expectations, and industry practices relevant to the business.
• Contribute to continuous improvement of security governance workflows and stakeholder engagement.

QUALIFICATIONS

• 5+ years of experience in information security, cybersecurity, risk management, governance, compliance, audit, or a related field.
• Strong understanding of information security principles, governance practices, and risk management processes.
• Experience coordinating security audits, assessments, findings, and remediation activities.
• Experience developing, maintaining, or supporting security policies, standards, procedures, and awareness programs.
• Strong written and verbal communication skills.
• Demonstrated ability to influence stakeholders across multiple business functions and regions.
• Strong analytical, organizational, and problem-solving skills.
• Ability to manage multiple priorities and deliver outcomes in a matrixed global environment.

EDUCATION AND EXPERIENCE

• Bachelor's degree in Information Security, Cybersecurity, Information Technology, Risk Management, Business Administration, or a related discipline is preferred.
• An equivalent combination of education, professional certification, and relevant experience may be considered.
• Professional certification such as CISSP, CISM, CRISC, CGRC, ISO 27001 Lead Implementer, or equivalent.