Senior Information Security Specialist

Introduction The Johannesburg Stock Exchange (JSE) is seeking a highly experienced Senior Information Security Specialist to join our Information Technology team. This role is responsible for driving Information Security Assurance services across the JSE technology landscape, ensuring the confidentiality, integrity, and availability of critical systems and data. As a subject matter expert, you will play a pivotal role in designing, implementing, monitoring, and evolving security controls across on-premises and cloud environments while ensuring compliance with industry standards and regulatory requirements. Duties & Responsibilities

Information Security Assurance & Risk Management

• Identify, assess, report on, and mitigate security risks across applications, infrastructure, and cloud environments.
• Conduct security risk assessments, audits, vulnerability assessments, and penetration testing activities.
• Drive the remediation of security vulnerabilities in line with established vulnerability management processes.
• Investigate security incidents, perform root cause analysis, and support forensic investigations.
• Develop and implement security metrics and reporting frameworks for senior management.

Security Architecture & Governance

• Provide specialist security input into enterprise architecture, solution design, and technology adoption initiatives.
• Ensure security principles are embedded throughout the Software Development Lifecycle (SDLC).
• Review architecture designs and recommend appropriate security controls and enhancements.
• Contribute to the development and maintenance of security policies, standards, and procedures.

Compliance & Regulatory Assurance

• Support regulatory and compliance audits.
• Drive remediation activities resulting from audit findings.
• Ensure alignment with industry and regulatory frameworks, including:
• POPIA
• Cyber Crimes Act
• SWIFT
• NIST
• ISO Standards
• OWASP
• CIS Controls
• Cloud Security Alliance (CSA)

Stakeholder & Vendor Management

• Partner with Information Security leadership, Enterprise Architects, IT teams, and business stakeholders.
• Manage relationships with security technology vendors and service providers.
• Engage with industry forums and security communities to stay ahead of emerging threats.

Security Operations & Continuous Improvement

• Provide Level 3 security support across the organisation.
• Monitor and maintain security technologies and controls.
• Lead and contribute to security projects and strategic initiatives.
• Mentor and support junior security professionals.
• Stay current with emerging cybersecurity threats, technologies, and best practices.

Desired Experience & Qualification

Qualifications

• Degree in Information Systems, Information Security, Computer Science, or a related field.
• One or more of the following certifications:
• CISSP
• CISM
• CISA
• CRISC
• Licensed Penetration Tester (LPT)
• Relevant F5 Certifications (101, 201, 301, 302, 303, 304)
• Cisco Security Certifications (including FireSIGHT IPS)
• Advantageous Certifications
• Certified Ethical Hacker (CEH)
• Application Penetration Testing Certifications
• Network Security Administrator (NSA)
• Certified Application Security Tester

Experience

• Minimum 10 years' IT experience.
• Minimum 7 years' experience in an Information Security Specialist role.
• Proven experience across enterprise security operations, governance, risk management, and security architecture.

Knowledge:

• Software applications (e.g., Outlook, Word, Excel, Access, Internet, Email)
• Knowledge in Microsoft Visio (Process flows)
• Penetration testing principals and methodologies
• Penetration testing techniques and tools (Burp, Metasploit, Wireshark, John the Ripper, Cain & Abel, Kali, Nmap)
• Software Development Lifecycle (Agile Adaptive & Waterfall Predictive)
• Intermediate programming knowledge
• Intermediate database knowledge
• Diagnostics/Troubleshooting for application, database & hardware
• Advanced Knowledge in Vulnerability Management process
• Advanced Knowledge in Vulnerability Management tools (Nessus, Rapid7, OpenVAS)
• Technology Products/Platforms and Solutions (Microsoft, Linux/Unix, VMWare)
• Advanced knowledge in various operational security controls
• Advanced knowledge in Networking Principles
• Advanced Knowledge in Industry standard Security principles
• Knowledge of Industry standards (ISO, NIST, OWASP, CIS, CSA)
• Knowledge of JSE specific regulatory standards and requirements (POPIA, SWIFT, Joint Standards Framework, Cyber Crimes Act)
• Knowledge in Industry standard Security design principles
• Information security principles in the enterprise architecture frameworks
• Cloud technologies (Azure and AWS) architecture and security
• Data Loss principles and data loss technologies
• Encryption principles, standards and technologies
• Operational security controls