Manager: Cyber Security Operations Centre (CSOC)

Sars; Pretoria; On-site; ZAR 1,200,000 - 1,800,000; Full time

Job summary

SARS in Pretoria is seeking a Manager for the Cyber Security Operations Centre (CSOC) and User Access Management (UAM). You will lead the SOC, monitor threats, manage incident response, and strengthen identity and access controls to protect information assets and services.

You will oversee internal teams and external security service providers, drive governance, risk management and security operations aligned with business objectives and regulatory requirements.

Qualifications

• Bachelor's degree in Information Security or related field with 8–10 years IT security experience.
• 3–4 years at junior management level and professional certification in Information Security Management.
• CISM or CISSP or equivalent certification required.

Responsibilities

• Lead CSOC and UAM functions ensuring monitoring, detection, and response to threats.
• Oversee governance, risk and compliance across security operations.
• Manage internal teams and external service providers to deliver service excellence.
• Align security operations with organisational goals and regulatory requirements.

Skills

Leadership

SOC operations

Incident response

IAM

Governance

Stakeholder management

Education

Bachelor's Degree / Advanced Diploma (NQF 7) Information Security

CISM Certification

CISSP Certification

Job description

Career Opportunities: Manager: Cyber Security Operations Centre (11599)

Requisition ID11599-Posted01/10/2026- Region (1) - Location (1)

Position Reports to: Area Head IT Security Operations

Advert Closing Date: 11 October 2026

About the Position

SARS is seeking a highly skilled, results-driven cybersecurity specialist with sound judgement, strong business acumen and a future-focused mindset. The successful candidate will contribute to SARS' higher purpose and service delivery by driving effective IT security controls and strengthening cyber resilience.

The Manager: Cyber Security Operations Centre is responsible for the strategic and operational management of the Security Operations Centre (SOC) and User Access Management (UAM) functions. The role ensures the effective implementation, monitoring and continuous improvement of information security controls to protect the organisation's information assets, systems and services.

The position translates information security strategy into operational execution, driving measurable outcomes across security monitoring, incident response, identity and access management, security governance and operational risk management. The role also manages internal teams and outsourced security service providers, ensuring service excellence, compliance and continuous capability improvement.

The successful candidate must demonstrate strong information security management experience, effective leadership and stakeholder management capabilities, and the ability to align security operations with organisational objectives and risk requirements.

Job Purpose

To lead and manage the Cyber Security Operations Centre (CSOC) and User Access Management (UAM) functions, ensuring the effective monitoring, detection, investigation and response to cyber threats, while strengthening identity and access management, operational resilience and the protection of SARS information assets, systems and services.

Education and Experience

Minimum Qualification & Experience Required

Bachelor's Degree / Advanced Diploma (NQF 7) Information Security AND 8-10 years' experience in an Information Technology Security, of which 3-4 years at a junior management level, as well as a recognised professional certification in Information Security Management, such as Certified Information Security Manager (CISM), Certified Information Systems Security Professional (CISSP), or an equivalent recognised certification.

Alternative #

Senior Certificate (NQF 4) AND 15 years Information Technology Security experience, of which 3 - 4 years at a junior management level, , as well as a recognised professional certification in Information Security Management, such as Certified Information Security Manager (CISM), Certified Information Systems Security Professional (CISSP), or an equivalent recognised certification.

Job Outputs:

Process

• Act as the bottom-line drivers of tactical implementation within the context of business unit excellence and performance improvement.


• Direct, control, coordinate and optimise budgeted resources to meet specific objectives and deliver agreed results and productivity requirements.


• Ensure the development and implementation of a practice in alignment with operational policy and procedural frameworks.


• Implement tactical strategy and delivery plans through the development of operational activities, ensuring the achievement of operational targets.


• Convert the approved tactical security strategy into a measurable operational plan, defining deliverables, performance measures, priorities and resource requirements.


• Plan for handling work outputs, pull together interdependent activities and specify priorities, standards and procedures to ensure tactical implementation.


• Provide periodic reports on performance against plan & progress on short-term initiatives & use to realign tactical plan and objectives appropriately.


• Recommend changes to optimise processes, systems, policies and procedures, and execute the implementation of change and innovation initiated by the organisation.


• Timeously communicate top-down policy modification, objective achievement progress and critical success factors to impacted stakeholders.


• Use the insights gained through integrated business reports to measure success and realign tactical strategy implementation objectives appropriately.


• Plan and manage projects in area of accountability.


• Provide integrated oversight and operational management of Security Operations Centre (SOC) and User Access Management functions to ensure effective protection of SARS information assets and services.


• Monitor the effectiveness of security controls, operational performance, service delivery standards, risks and compliance requirements, and implement corrective actions where deficiencies are identified.


• Provide technical direction for the development, design and integration of systems to prevent the loss of SARS assets.


• Liaise with vendors to get product and service level issues resolved.

Governance

• Implement governance, risk and compliance policy in own practice area to identify and manage governance and risk exposure liability.


• Manage and or advise on the translation and application of policy in a specific functional area.


• Comply with organisational internal control and governance standards in finance and procurement processes.

People

• Develop and implement appropriate people capacity plans in line with delivery and efficiency targets, on budget and in partnership with specialised area.


• Plan and implement enhanced organisational efficiency by identifying and addressing development requirements and providing tools for people resources.


• Translate performance expectations into specific metrics and goals to identify and provide effective services, solve problems and achieve objectives.


• Ensure compliance with applicable health, safety, security and workplace policies within the Cyber Security Operations Centre environment.

Finance

• Draw up a budget aligned to tactical delivery plans, monitor planned vs. actual, minimise expenditure and report on cost efficiency.


• Implement and monitor financial control, management of costs and corporate governance in area of accountability.

Client

• Build strong relationships and implement service level agreements that promote SARS with internal and external stakeholders.


• Develop and ensure implementation of practices which builds service delivery excellence and encourage others to provide exceptional client service.


• Manage an integrated service excellence culture, which builds rewarding relationships and provides opportunity for feedback and exceptional service.

Compliance Competency

• GOC Confidential

Employment Equity

The Employment Equity policy of SARS will be considered as part of the recruitment and selection process and Persons with Disabilities are encouraged to apply. Successful candidates will be required to undertake an oath of secrecy, pre-employment screening, case study, pre-assessment, psychometric assessment and or vetting, and a declaration of private interest. The appointment is also subject to appropriate reference(s) and security clearance where applicable.