Security Engineer (Cyber Security & GRC)

Job Description

Role Purpose

• The Security Engineer is Kaelo’s dedicated cyber security capability. Reporting to the Head of IT, the role combines hands-on engineering of security controls across the technology estate with the governance, risk and compliance work required to evidence those controls to regulators, auditors and customers.
• A significant part of the role is security assurance in both directions: completing the security questionnaires that customers send to Kaelo, assessing Kaelo itself and its vendors, and working with internal teams or the vendor concerned to close the gaps found.
• The incumbent also creates and maintains the Information Security Management System (ISMS) supporting Kaelo’s pursuit of ISO 27001 certification, under the direction of the IT Executive, and supports alignment to FSCA Joint Standard 2, POPIA, the Cybercrimes Act, the CIS Controls and the NIST Cybersecurity Framework.

Key Responsibilities

Security Engineering & Control Implementation

• Implement, configure and maintain technical security controls across endpoints, servers, cloud, network and identity.
• Operate endpoint detection and response, email security, web filtering and data loss prevention tooling.
• Harden systems against CIS Benchmarks and maintain secure baseline configurations across the estate.
• Work with the Cloud Engineer to apply security controls in the Cloud and co-location environments.

Identity & Access Management

• Maintain multi-factor authentication, conditional access and privileged access controls, enforcing least privilege.
• Run periodic user access reviews and retain the evidence these produce.
• Ensure joiner, mover and leaver processes are enforced and evidenced.

Vulnerability Management, Monitoring & Incident Response

• Run vulnerability scanning, triage and remediation tracking, and co-ordinate penetration tests and the closure of their findings.
• Monitor security alerts and logs, triage events and escalate in line with the incident response plan.
• Support the response to security incidents, including containment, recovery and post-incident review, under the direction of the IT Executive and as executed by the Head of IT.
• Support statutory notification obligations, including POPIA breach notification and reporting under the Cybercrimes Act.

Security Questionnaires & Third-Party Assurance

• Complete security questionnaires received from customers and prospective customers, providing accurate responses and supporting evidence on Kaelo’s behalf.
• Maintain a library of approved standard responses, policies and evidence so that questionnaires are answered consistently and quickly.
• Issue security questionnaires to Kaelo’s vendors and service providers, assess the responses and rate the risk.
• Self-assess Kaelo against its own policies and the frameworks it aligns to, identifying control gaps.
• Work with internal teams or the relevant vendor to agree remediation of gaps and track it through to closure.

ISMS, Governance & Compliance

• Maintain the ISMS under the direction of the IT executive, including the risk register, risk treatment plan and Statement of Applicability.
• Implement and evidence Annex A controls, and maintain the evidence required for internal audit and ISO 27001 certification audits.
• Support control mapping and gap assessment against FSCA Joint Standard 2, the CIS Controls and the NIST Cybersecurity Framework.
• Maintain the information security policy set and support POPIA compliance in partnership with the Information Officer.

Awareness, Resilience & Reporting

• Run the security awareness programme, including phishing simulation.
• Contribute to business continuity and disaster recovery planning from a cyber resilience perspective.
• Report on security posture, questionnaire activity, vendor risk and gap remediation to the Head of IT and IT executive.

Alignment, Reporting & Escalation

• Align work to, and execute, the direction and strategy set by the IT Executive.
• Communicate progress and escalate issues and risks to the IT Executive, through the Head of IT where appropriate, promptly and transparently.

Qualifications

Qualifications

• Bachelor’s degree or national diploma in Computer Science, Information Systems, Information Security or a related field.
• Recognised security certification such as CompTIA Security+, CySA+ or Microsoft SC-200/SC-300; CISSP, CISM or ISO 27001 Lead Implementer advantageous.

Experience

Essential

• Minimum 5 years’ experience in information or cyber security, with hands-on technical depth.
• Experience implementing and operating technical security controls across endpoint, network, cloud and identity.
• Experience completing or assessing third-party security questionnaires and tracking remediation of the gaps found.
• Practical exposure to ISO 27001, the CIS Controls or the NIST Cybersecurity Framework.
• Experience with vulnerability management and security monitoring.
• Working knowledge of POPIA and its application to security controls.

Preferred

• Exposure to an ISO 27001 certification or surveillance audit.
• Experience in financial services, insurance or healthcare, and familiarity with FSCA Joint Standard 2.
• Experience with Microsoft security tooling (Defender, Sentinel, Entra ID).
• Scripting ability for security automation and evidence collection.

Technical Competencies

• Security Control Implementation across Endpoint, Network, Cloud & Identity
• Security Questionnaire Completion & Evidence Management
• Vendor Security Assessment & Third-Party Risk
• Control Gap Assessment & Remediation Tracking
• ISO/IEC 27001 ISMS Operation & Annex A Controls
• FSCA Joint Standard 2, CIS Controls & NIST CSF
• POPIA & Cybercrimes Act Application
• Identity, Access & Privileged Access Management
• Vulnerability Management
• Security Monitoring & Incident Response
• Security Awareness Programme Delivery

Core Competencies

• Judgement — distinguishes real risk from theoretical risk and prioritises accordingly.
• Integrity — represents Kaelo’s security position accurately to customers, auditors and management.
• Clear Communication — writes precise questionnaire responses and explains gaps plainly to vendors and internal teams.
• Influence — secures cooperation for remediation without formal authority over those implementing it.
• Ownership & Accountability — drives findings to closure rather than to a register.

Key Performance Indicators (KPIs)

• Turnaround time and accuracy of customer security questionnaire responses.
• Proportion of in-scope vendors assessed, and vendor gaps remediated within agreed timeframes.
• Closure of gaps identified in Kaelo’s self-assessments.
• Currency of the ISMS risk register, risk treatment plan and Statement of Applicability.
• Vulnerability remediation within agreed service levels by severity.
• Closure rate of penetration test and audit findings.
• Awareness programme completion and phishing simulation results.

Regulatory, Risk & Information Security Responsibilities

• Comply with POPIA in the handling of personal and special personal information, including member health information, and with the Cybercrimes Act, reporting any suspected unlawful access or compromise without delay.
• Adhere to Kaelo information security policies and the frameworks the organisation aligns to, including FSCA Joint Standard 2 of 2024, ISO/IEC 27001, the CIS Controls and the NIST Cybersecurity Framework.
• Maintain the evidence required to support the ISMS and internal, external and certification audits within the area of responsibility.
• Escalate security incidents, control weaknesses and operational risks promptly, and complete all mandatory compliance and awareness training.