{"id":3674265,"url":"https://alion.io/job/clicks-group-group-cyber-security-manager","title":"Group Cyber Security Manager","company":{"id":2916013,"name":"Clicks Group","domain":"clicksgroup.co.za","url":"https://alion.io/company/clicksgroup","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Careers Interface","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Cape Town, South Africa"],"countries":["ZA"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Active Directory","optional":false},{"name":"Azure","optional":false},{"name":"Least Privilege","optional":false},{"name":"LLM","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"NIST AI RMF","optional":false},{"name":"NIST CSF","optional":false},{"name":"OWASP","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"PCI DSS","optional":false},{"name":"PKI","optional":false},{"name":"SIEM","optional":false},{"name":"VPN","optional":false},{"name":"Zero Trust","optional":false}],"status":"live","first_seen_at":"2026-11-03T10:12:19Z","employer_posted_date":"2026-11-03","last_verified_at":"2026-11-08T17:07:28Z","board_verified":true,"closed_at":null,"days_open":5,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":5},"description":"About our company\nClicks Group\nIntroduction\nThis is an opportunity to lead the cyber and information security across a complex, multi-brand\nGroup and shape how the organisation protects its customers, people, information and\noperations against an increasingly sophisticated threat landscape.\nReporting to the Executive for Cyber Security and Governance, the Cyber Security Manager\nestablishes and operates the Group's cyber security programme, translates business priorities\nand risk appetite into security priorities, and provides executive management with a clear,\nevidence-based view of material cyber risk, control effectiveness and resilience.\nThe role combines leadership with technical depth. The successful candidate will set the\ndirection and standards, lead specialist teams and security partners, challenge technology\nand business owners on material risks, and remain sufficiently close to the technology to direct\ncomplex investigations, validate controls and lead the response to significant cyber incidents.\nJob description\nJOB PURPOSE\nThe Cyber Security Manager is responsible for establishing, operating and continually\nstrengthening the Group's cyber security programme across corporate, retail, pharmacy,\ndistribution, digital and cloud environments.\nAccountable for the Group’s cyber security posture across IT systems, infrastructure and networks, protecting them against cyber-attacks, intrusions, malware and data breaches.\nDevelop the cyber security strategy and roadmap from an assessment of IT security needs and business objectives.\nProvide executive management with a clear view of material cyber risks, emerging threats, control effectiveness, significant incidents and remediation priorities.\nMaintain and improve cyber security incident response plans and playbooks (including ransomware, phishing and AI-enabled fraud such as deepfake impersonation), lead and coordinate the response to security incidents, preserve evidence, coordinate regulatory notifications with Group Legal, and brief executive management on root cause and remediation.\nOversee vulnerability management, security risk assessments and the penetration testing programme.\nDefine and integrate standardised security controls into IT applications and infrastructure, including store, point-of-sale, pharmacy and distribution environments, and drive their continuous improvement.\nOversee threat intelligence, emerging-threat research, external attack surface\nmonitoring (including domain spoofing and brand impersonation) and security tool\nevaluation, and provide cyber risk inputs to the consolidated IT risk register.\nReport cyber security risk monthly (dashboards and key risk indicators) to executive management.\nOwn the IT security budget, licensing, renewals, vendor relationships and cost allocation across Group entities, driving cost-effective delivery of strategic objectives.\nManage the Cyber Security Lead (penetration testing, vulnerability management and security assessments) and the Information Security Lead (information security operations and access management), and through them their respective teams: set priorities, standards and performance measures, recruit, develop and performancemanage staff, and ensure the teams have the skills and resources they need.\nEmbed security requirements into IT projects and new solutions from design through go-live, ensuring risk-based penetration testing is scoped and budgeted with the Cyber Security Lead within project delivery.\nJOB OBJECTIVES\nDevelop and maintain the Group cyber security strategy and multi-year roadmap based on business priorities, the technology landscape, cyber threats, regulatory requirements and the current maturity of security capabilities.\nMaintain the NIST CSF-aligned cyber security programme and IT security policies, approving policy deviations within delegated authority based on documented risk acceptance.\nLead and perform complex investigations, configuration reviews and troubleshooting across security platforms.\nAct as escalation point for the outsourced SOC/MDR provider: direct containment, separate authorised testing from genuine threats, close visibility gaps, and manage provider performance against SLAs and detection coverage.\nOwn identity and access governance, including joiner-mover-leaver processes, access reviews, privileged and third-party access, and segregation of duties.\nOwn data security controls, including data loss prevention, sensitivity labelling and encryption of sensitive and special personal information.\nLead the cyber security workstream of audits and maturity assessments through to remediation closure, and own the annual PCI DSS compliance programme.\nAct as security approver on the Change Advisory Board, including least-privilege review of firewall changes and delegation within the team, and provide security architecture input to significant changes and projects.\nMaintain the security posture of Microsoft 365, Entra ID, Azure and critical SaaS platforms, and define application and API security requirements for digital channels, including secure development and testing before release.\nProvide security input to supplier and SaaS risk assessments and contractual security clauses.\nDefine the Group's cyber security requirements for enterprise AI technologies and AIenabled solutions.\nProvide security oversight of risks associated with enterprise AI use, including inappropriate information exposure, excessive permissions, unsanctioned tools, agent access, prompt injection, data leakage and manipulation of AI-enabled processes.\nAssess material AI solutions from a cyber security perspective before implementation and ensure security requirements are incorporated into solution design and governance.\nDraw on recognised AI security and risk practices including the NIST AI Risk Management Framework, OWASP guidance for LLM applications and ISO/IEC 42001 where appropriate.\nDefine risk-based security requirements for material technology suppliers, SaaS providers and third parties with access to Group information, systems or critical services.\nProvide security assessment and challenge as part of supplier onboarding and material technology procurement, including review of relevant security evidence and identification of contractual security requirements.\nMonitor significant supplier-security exposures and ensure identified risks are assigned and remediatedor formally accepted.\nProcurement, Legal and the accountable business owner retain responsibility for commercial decisions and acceptance of residual business risk.\nDefine and validate cyber recovery requirements, including immutable backups and protected recovery credentials, and drive cyber incident and recovery simulations.\nRun security awareness training with Legal Compliance, covering AI-enabled social engineering and targeted phishing simulations for high-risk users.\nMinimum requirements\nQUALIFICATIONS\nDegree or Diploma in Information Technology / Systems Engineering / Computer Science or a relevant equivalent qualification.\nCISSP or CISM certification (or equivalent).\nA relevant hands-on technical security certification, or a cloud security certification such as CCSP, is an advantage\nJOB-RELATED KNOWLEDGE & EXPERIENCE\nAt least 8 years (Diploma) or 7 years (Degree) of experience in the IT environment, including at least 5 years of hands-on cyber or information security experience and 3 years or more managing technical security teams and team leads.\nStrong knowledge of the design, configuration, maintenance and support of IT cyber security systems and architecture within an enterprise environment.\nExperience running vulnerability management programmes and coordinating patch remediation with technology owners, including remediation SLAs.\nHands-on proficiency in several of: EDR/XDR, SIEM/MDR operations, privileged access management, identity governance, Active Directory and Entra ID, Microsoft 365 security, zero trust network access, email security, next-generation firewalls and VPN, PKI and certificates, and cloud and web application security.\nPractical experience in incident response, log analysis, threat hunting and forensic evidence handling.\nProven ability to translate technical security risk into clear business language for executive management and non-technical stakeholders.\nStrong knowledge of IT governance, risk and compliance practices and frameworks such as NIST CSF, ISO/IEC 27001/27002, CIS Controls and PCI DSS, with experience preparing for and responding to internal and external audits.\nExperience managing managed security service providers, security licensing and budgets within a multi-entity group.\nWorking knowledge of AI security risks and frameworks such as the OWASP Top 10 for LLM Applications, NIST AI RMF and ISO/IEC 42001.\nKnowledge of regulatory requirements such as the Protection of Personal Information Act (POPIA) and the Cybercrimes Act, including breach notification obligations.\nJOB-RELATED SKILLS\nExcellent written and verbal communication skills\nAbility to collaborate cross-functionally and build strong relationships with stakeholders at all levels\nIT strategy, planning and governance\nCyber and information security management\nSecurity architecture and engineering\nIdentity and access management\nCyber security risk management and control monitoring\nData protection\nIncident response coordination and forensic evidence handling\nApplication and API security\nThird-party security risk management\nCommercial and vendor management\nExecutive reporting and communication\nPeople leadership and capability development\nJOB-RELATED COMPETENCIES\nLeading and Supervising\nDelivering Results and Meeting Customer Expectations\nRelating and Networking\nApplying Expertise and Technology\nAnalysing and Interpreting\nAdapting and Responding to Change\nDeciding and Initiating Action\nPresenting and Communicating Information\nPersuading and Influencing\nPlanning and Organising","description_format":"text","description_chars":9936,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Commerce","Information Security","Pharmacies"],"lifecycle":[{"event":"open","at":"2026-11-03T10:12:19Z"}],"visa":[],"liveness":{"score":38,"band":"fade","label":"Fading","p_open":1,"p_active":0.797,"p_room":0.473,"age_days":4,"expected_fill_days":3,"reasons":["conf:1","velocity","win:tail"],"computed_at":"2026-11-08T05:47:12Z"},"pay":null,"html_url":"https://alion.io/job/clicks-group-group-cyber-security-manager","json_url":"https://alion.io/job/clicks-group-group-cyber-security-manager.json","meta":{"generated_at":"2026-11-08T21:15:37Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":44361,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-09T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2916013},"rest":"https://alion.io/mcp/rest/get_company?id=2916013"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fclicks-group-group-cyber-security-manager"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fclicks-group-group-cyber-security-manager"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fclicks-group-group-cyber-security-manager"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/clicks-group-group-cyber-security-manager\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fclicks-group-group-cyber-security-manager"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3674265}},{"tool":"search_jobs","arguments":{"company":"clicksgroup.co.za","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3674265},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}