Manager: Security Operations and Incident Managemen

MTN Group Management Services (Pty) Ltd; Roodepoort; On-site; ZAR 900,000 - 1,400,000; Full time

Job summary

MTN Group Management Services (Pty) Ltd in Roodepoort, Gauteng, seeks a seasoned professional to lead Security Operations and Incident Management. You will coordinate incident response across MTN group entities, manage vendors, and drive continuous improvement of security processes and tooling.

The role requires 5–6 years in information security, strong knowledge of SIEM/SOAR, and hands-on scripting with Python/PowerShell. Telecom/large enterprise experience is a plus.

Qualifications

• Bachelor’s degree in CS/IT or related field.
• 5–6 years in information security or security operations.
• Experience in incident management, SIEM/SOAR, and security tooling.

Responsibilities

• Manage incident management processes per group and OpCo requirements.
• Coordinate incident activities across the group and with external vendors.
• Escalate risks and issues to senior management in technology.
• Support incident management reporting (KPIs, SLAs).
• Drive standardisation and end-to-end application of incident management.

Skills

Incident management

Security operations

SIEM/SOAR

Vendor evaluation

Automation scripting

Threat intelligence

Education

Bachelor’s degree in computer science / IT / related field

Certifications: CISSP / CISM / SC-200 / AZ-500 / CCSP / AWS / Azure security

Tools

SIEM/SOAR

EDR/XDR

PowerShell

Python

KQL

REST APIs

Job description

We at MTN are a purpose and value-led organization. At MTN, we believe that understanding our people’s needs and aspirations is key to creating experiences that delight you at work, everyday. We are committed to fostering an environment where every member of our Y’ello Family is heard, understood and empowered to live an inspired life.

Our values keep us grounded and moving in the right direction. Most importantly, they keep us honest. It is not something we claim to be. It is in our DNA.

As an organisation, we consider it our mission to create an exciting and rewarding place to work, where our people can be themselves, thrive in positivity and ignite their full potential. A workplace that boosts creativity and innovation, improves productivity, and ultimately drives meaningful results. A workplace that is built on relationships and achieving a purpose that is bigger than us.

Our commitments go beyond an organisational promise. It is in our leadership and managerial ethos to meaningfully partner with our employees, customers and stakeholders with a vision to realise our shared goals.

• Lead with Care
• Can-do with Integrity
• Collaborate with Agility
• Serve with Respect
• Act with Inclusion

Mission/ Core purpose of the Job

Responsible for managing incident management processes in accordance with industry best practices. The role provides support for operational security response activities, major incident coordination, escalation management, stakeholder communications, root cause analysis, SLA performance monitoring, and continuous service improvement.

The role also acts as the SOC technical lead for strategic security technology initiatives, including RFI/RFP technical requirements, Statements of Work, vendor technical evaluation, solution-fit validation, integration requirements, future-state operating models, implementation considerations and governance recommendation packs. This role is responsible for ensuring the technical requirements are clear, measurable, future-fit and aligned to MTN’s SOC, architecture, security and operational needs.

Key Performance Areas:

Core, essential responsibilities / outputs of the position (KPA's)

The Manager: Security Operations and Incident Management will be accountable to achieve the following objectives:

• Executing the incident management process tasks in adherence with group and local OpCo requirements.
• Coordinate and manage the incident management process activities across the group and with external vendors as per agreed SLAs.
• Escalate risks and issues to the senior management within the technology function
• Support incident management reporting (KPIs and customer SLAs)
• Assist the incident management process owners within OpCos in:
• Driving service management best-practice and process standardisation
• Implementing consistent end-to-end application of the incident management process across the business
• Identifying and planning for incident management process improvement projects
• driving cross-account process standardisation
• Drive implementation of standard execution of the incident management process
• Responsible for the complete process adherence and handling of incidents according to SLAs
• Responsible for acting as an escalation point to expedite incident resolution

Strategic SOC Contribution

• Support implementation of the strategic roadmap of the Group SOC, ensuring alignment with business objectives and emerging threat trends.
• Drive visibility enhancement initiatives, including onboarding of critical assets, improving telemetry coverage, and reducing detection blind spots.
• Collaborate with SOC Engineering, Threat Intelligence, and Detection teams to enhance detection rules, response playbooks, and automation.
• Assist in identifying operational improvements and process efficiencies that reduce MTTD, MTTR, and enhance SOC efficiency and maturity.
• Provide operational input to SOC enhancement initiativesto improve correlation, enrichment, and response automation.

Technical Lead for RFI/RFP, SOW and Vendor Evaluation

• Participate in vendor demonstrations and proof-of-concept activities.
• Support the development of technical requirements as requested by architecture and procurement teams.
• Assist with vendor performance reviews and ongoing operational service assessments.
• Provide operational and technical input into security technology evaluations for RFI/RFP activities, working with Procurement, GSSC, solution architecture, security architecture and relevant business stakeholders.
• Develop or contribute to Statements of Work, technical questionnaires, technical evaluation criteria, vendor assessment frameworks, shortlisting rationale and recommendation packs.
• Ensure RFI/RFP requirements describe MTN’s current environment, target state, integration expectations, scale, data sources, telemetry needs, OpCo context, regulatory constraints, operating model and implementation assumptions.
• Validate vendor claims through evidence review, demonstrations, reference checks, proof-of-compliance, site visits where required, technical due diligence and fit-for-purpose analysis.
• Ensure evaluation outcomes are objective, evidence-based, documented and aligned to the approved scoring process.
• Distinguish clearly between technical evaluation and procurement/commercial decision-making: Procurement owns process governance, sourcing rules, commercial evaluation and contracting; the role owns SOC technical content, requirements and technical recommendation.
• Support implementation of approved security solutions.
• Provide operational requirements and incident-response considerations during solution deployment.
• Assist with testing and operational readiness activities.

AI, LLM, Automation

• Support adoption of approved automation and AI-enabled capabilities within security operations.
• Identify operational opportunities for automation.
• Escalate AI-related risks to Security Architecture and Governance teams

Governance, Business Cases & Decision Forums

• Provide operational reporting and technical input for governance submissions.
• Support preparation of status updates and incident management performance reports.
• Prepare and present technical recommendations, , decision papers and progress updates to governance and decision-making forums.
• Ensure submissions clearly describe purpose, decision required, value, risks, financial implications, stakeholders consulted, architecture alignment, security implications, implementation plan and residual risks.
• Translate technical findings into executive-ready risk, business and operational language, including clear recommendations, options, trade-offs and decision rationale for Senior Manager review
• Ensure solution decisions are aligned to MTN Group strategy, architecture standards, information security requirements, OpCo needs and regulatory constraints.
• Ensure SLA adherence
• Improve visibility, telemetry and detection capabilities
• Ensure safe and governed AI adoption
• Lead technical aspects of RFI/RFP processes
• Develop SOWs and technical requirements
<
• Active support from the Group CTIO, GM: Enterprise Services and SM: Service Delivery
• Deep understanding of the MTN business strategy
• Understanding of the OpCo technology, business and regulatory context
• Timely decision making and reporting
• Alignment of OpCo and Group strategy initiatives

Job Requirements (Education, Experience and Competencies)

Education:

• Bachelor’s degree in computer science, Information Technology, Software Engineering or related field
• One or more relevant industry certifications (as per below)

Certifications:

• CISSP, CISM or equivalent security certification advantageous
• Microsoft Security certifications (SC-200, AZ-500).
• Cloud security certifications (CCSP, AWS or Azure security specialty).

Experience:

• 5–6 years' experience in information security, cybersecurity operations or a related technology environment.
• Experience in the following areas: Security Monitoring, Incident Response, Security Operations, or Security Tool Administration.
• Experience supporting the implementation and operation of security automation solutions within enterprise environments
• Experience operating in large, complex enterprise environments; telecommunications experience is an advantage.
• Experience participating in RFI/RFP, vendor evaluation, technical scoring, SOW development, proof-of-concept, proof-of-compliance, solution selection or technical due diligence activities.
• Proven track record of business improvement and strategy development
• Strong knowledge of SIEM and SOAR and EDR/XDR tooling (e.g. Microsoft Defender).
• Proficiency in scripting and automation (Python, PowerShell, KQL) and integration via REST APIs.
• Practical knowledge of cloud security across Azure, AWS and/or GCP.
• Familiarity with AI/ML and LLM security concepts, agentic AI, and secure AI adoption.
• Working knowledge of security frameworks: MITRE ATT&CK, MITRE ATLAS, NIST CSF, OWASP, Zero Trust and CIS.
• Sound understanding of networking, operating systems and enterprise infrastructure.

Other:

• Regional and international travel

MTN Group is an equal opportunity employer with an imperative and obligation to achieve its own set EE targets and the legislated Employment Equity targets. Preference will first be given to previously disadvantaged individuals/groups with a specific focus on females and differently abled persons