Security Engineer (Cyber Security & GRC)

Kaelo

Randburg

Presencial

ZAR 900 000 - 1 200 000

Tempo integral

Há 2 dias

Torna-te num dos primeiros candidatos

Gerador de candidaturas

Uma candidatura feita para esta oferta de emprego — um currículo e uma carta de apresentação personalizados que vão ao encontro do anúncio.

Ultrapassa os filtros ATS

Resumo da oferta

Kaelo is seeking a Security Engineer to drive security controls across endpoints, servers, cloud and identity, while developing the ISMS and supporting ISO 27001 certification.

Reporting to the Head of IT, you will handle security questionnaires, third‑party risk, and alignment to CIS and NIST frameworks, POPIA and FSCA standards. The role requires 5+ years of hands-on security experience and relevant certifications.

Qualificações

Minimum 5 years’ experience in information or cyber security.
Hands-on experience implementing and operating technical security controls across endpoint, network, cloud and identity.
Experience completing or assessing third-party security questionnaires and tracking remediation of gaps found.
Practical exposure to ISO 27001, CIS Controls or the NIST Cybersecurity Framework.

Responsabilidades

Implement, configure and maintain technical security controls across endpoints, servers, cloud, network and identity.
Operate endpoint detection and response, email security, web filtering and data loss prevention tooling.
Run vulnerability scanning, triage and remediation tracking; coordinate penetration tests and closure of findings.
Support the ISMS, governance and compliance activities, including risk registers and evidence for audits.

Conhecimentos

Security controls

Security governance

Vendor risk assessment

Security questionnaires

ISMS operations

POPIA compliance

Security awareness

CIS Controls

NIST CSF

Formação académica

Bachelor's degree or national diploma in Computer Science, Information Systems, Information Security or a related field

Ferramentas

Microsoft Defender

Microsoft Sentinel

Entra ID

Descrição da oferta de emprego

About Kaelo

Kaelo provides essential healthcare solutions ensuring the physical and psychosocial wellbeing of all South Africans towards lasting social change. Kaelo meets the Healthcare needs of Corporate and Retail clients across South Africa – products offerings include Medical Insurance, Medical Aid, Gap Insurance, Kaelo Money and employee assistance programmes.

Company Description

Job Description

The Security Engineer is Kaelo's dedicated cyber security capability. Reporting to the Head of IT, the role combines hands-on engineering of security controls across the technology estate with the governance, risk and compliance work required to evidence those controls to regulators, auditors and customers. A significant part of the role is security assurance in both directions: completing the security questionnaires that customers send to Kaelo, assessing Kaelo itself and its vendors, and working with internal teams or the vendor concerned to close the gaps found. The incumbent also creates and maintains the Information Security Management System (ISMS) supporting Kaelo's pursuit of ISO 27001 certification, under the direction of the IT Executive, and supports alignment to FSCA Joint Standard 2, POPIA, the Cybercrimes Act, the CIS Controls and the NIST Cybersecurity Framework.

Key Responsibilities

Security Engineering & Control Implementation
Implement, configure and maintain technical security controls across endpoints, servers, cloud, network and identity.
Operate endpoint detection and response, email security, web filtering and data loss prevention tooling.
Harden systems against CIS Benchmarks and maintain secure baseline configurations across the estate.
Work with the Cloud Engineer to apply security controls in the Cloud and co-location environments.
Identity & Access Management
Maintain multi-factor authentication, conditional access and privileged access controls, enforcing least privilege.
Run periodic user access reviews and retain the evidence these produce.
Ensure joiner, mover and leaver processes are enforced and evidenced.
Vulnerability Management, Monitoring & Incident Response
Run vulnerability scanning, triage and remediation tracking, and coordinate penetration tests and the closure of their findings.
Monitor security alerts and logs, triage events and elevate in line with the incident response plan.
Support the response to security incidents, including containment, recovery and post-incident review, under the direction of the IT Executive and as executed by the Head of IT.
Support statutory notification obligations, including POPIA breach notification and reporting under the Cybercrimes Act.
Security Questionnaires & Third-Party Assurance
Complete security questionnaires received from customers and prospective customers, providing accurate responses and supporting evidence on Kaelo's behalf.
Maintain a library of approved standard responses, policies and evidence so that questionnaires are answered consistently and quickly.
Issue security questionnaires to Kaelo's vendors and service providers, assess the responses and rate the risk.
Self-assess Kaelo against its own policies and the frameworks it aligns to, identifying control gaps.
Work with internal teams or the relevant vendor to agree remediation of gaps and track it through to closure.
ISMS, Governance & Compliance
Maintain the ISMS under the direction of the IT executive, including the risk register, risk treatment plan and Statement of Applicability.
Implement and evidence Annex A controls, and maintain the evidence required for internal audit and ISO 27001 certification audits.
Support control mapping and gap assessment against FSCA Joint Standard 2, the CIS Controls and the NIST Cybersecurity Framework.
Maintain the information security policy set and support POPIA compliance in partnership with the Information Officer.
Awareness, Resilience & Reporting
Run the security awareness programme, including phishing simulation.
Contribute to business continuity and disaster recovery planning from a cyber resilience perspective.
Report on security posture, questionnaire activity, vendor risk and gap remediation to the Head of IT and IT executive.
Alignment, Reporting & Escalation
Align work to, and execute, the direction and strategy set by the IT Executive.
Communicate progress and elevate issues and risks to the IT Executive, through the Head of IT where appropriate, promptly and transparently.

Qualifications

Bachelor's degree or national diploma in Computer Science, Information Systems, Information Security or a related field.
Recognised security certification such as CompTIA Security+, CySA+ or Microsoft SC-200/SC-300; CISSP, CISM or ISO 27001 Lead Implementer advantageous.

Experience

Essential

Minimum 5 years’ experience in information or cyber security, with hands-on technical depth.
Experience implementing and operating technical security controls across endpoint, network, cloud and identity.
Experience completing or assessing third-party security questionnaires and tracking remediation of the gaps found.
Practical exposure to ISO 27001, the CIS Controls or the NIST Cybersecurity Framework.
Experience with vulnerability management and security monitoring.
Working knowledge of POPIA and its application to security controls.

Preferred

Exposure to an ISO 27001 certification or surveillance audit.
Experience in financial services, insurance or healthcare, and familiarity with FSCA Joint Standard 2.
Experience with Microsoft security tooling (Defender, Sentinel, Entra ID).
Scripting ability for security automation and evidence collection.

Technical Competencies

Security Control Implementation across Endpoint, Network, Cloud & Identity
Security Questionnaire Completion & Evidence Management
Vendor Security Assessment & Third-Party Risk
Control Gap Assessment & Remediation Tracking
ISO/IEC 27001 ISMS Operation & Annex A Controls
FSCA Joint Standard 2, CIS Controls & NIST CSF
POPIA & Cybercrimes Act Application
Identity, Access & Privileged Access Management
Vulnerability Management
Security Monitoring & Incident Response
Security Awareness Programme Delivery

Core Competencies

Judgement — distinguishes real risk from theoretical risk and prioritises accordingly.
Integrity — represents Kaelo’s security position accurately to customers, auditors and management.
Clear Communication — writes precise questionnaire responses and explains gaps plainly to vendors and internal teams.
Influence — secures cooperation for remediation without formal authority over those implementing it.
Ownership & Accountability — drives findings to closure rather than to a register.

Key Performance Indicators (KPIs)

Turnaround time and accuracy of customer security questionnaire responses.
Proportion of in-scope vendors assessed, and vendor gaps remediated within agreed timeframes.
Closure of gaps identified in Kaelo’s self-assessments.
Currency of the ISMS risk register, risk treatment plan and Statement of Applicability.
Vulnerability remediation within agreed service levels by severity.
Closure rate of penetration test and audit findings.
Awareness programme completion and phishing simulation results.

Regulatory, Risk & Information Security Responsibilities

Comply with POPIA in the handling of personal and special personal information, including member health information, and with the Cybercrimes Act, reporting any suspected unlawful access or compromise without delay.
Adhere to Kaelo information security policies and the frameworks the organisation aligns to, including FSCA Joint Standard 2 of 2024, ISO/IEC 27001, the CIS Controls and the NIST Cybersecurity Framework.
Maintain the evidence required to support the ISMS and internal, external and certification audits within the area of responsibility.
Escalate security incidents, control weaknesses and operational risks promptly, and complete all mandatory compliance and awareness training.

Additional Information

Personal Attributes