Head of Information Security & Risk

Are you a security minded leader with a passion for protecting data, managing risk and building trust across a growing business? Join our Information Security & Risk team as Head of Information Security & Risk in Plattekloof, where you’ll own Herotel’s cyber security, IT risk and assurance, and IT and AI governance, and serve as our Information Officer under POPIA and PAIA.

This role is perfect for a decisive, strategic and resilient security professional who thrives on setting the standard, enjoys reporting to executives and boards, and is excited to lead a small, high impact team.

What you’ll do:

• Own Herotel’s cyber security strategy, programme and control framework across cloud, on premises and network environments
• Drive the Zero Trust and identity roadmap, including Conditional Access, compliant devices, passwordless and privileged access
• Oversee security operations and make decisions on security tooling and managed security services (MDR/SOC), in line with the Maziv group
• Act as the decision point for major security incidents, including executive communication
• Set security baselines, guardrails and identity standards for AWS, Azure, Microsoft 365 and software development, and track compliance and remediation with the Technology teams
• Run the security and POPIA review gate for new systems, automations, AI agents and significant changes before go live
• Own IT disaster recovery and business continuity policy, RTO and RPO targets and the annual DR test programme, and report results to Exco and the Audit Committee
• Sponsor the ISO 27001 programme and own the information security policy framework, with ISO 27001 certification achieved within the agreed timeline
• Maintain the IT risk register and report on cyber and IT risk to Exco, the Audit & Risk Committee, the Board and the Maziv group
• Lead the IT scope of the annual external IT audit (ITGC/ITAC) and quarterly privileged and user access reviews, tracking findings to closure
• Set and manage the cyber security and compliance budget, vendors and contracts with the CFO
• Serve as Herotel’s Information Officer under POPIA and PAIA, owning the compliance framework, DPIAs, operator agreements and data subject requests within POPIA timelines
• Own the AI policy framework and the AI tool and connector approval process, and administer Herotel’s enterprise AI platforms
• Oversee security awareness, phishing simulation and POPIA training, and deliver the weekly cyber security pack to managers and Exco
• Act as product owner of Herotel’s in house security platforms (IT Metrics, My IT Status and CodeScan)
• Lead, develop and manage the performance of the Cybersecurity Engineer and the IT Governance, Risk & Compliance Officer

What you’ll need:

• A Bachelor’s degree in Computer Science, Information Technology, Information Systems, Information Security or a related field
• A minimum of 10 years’ IT experience, including at least 5 years in cyber security or IT risk and 5 years in a leadership role
• Proven experience securing and governing AWS and Azure environments, including Microsoft Entra ID and Zero Trust controls such as Conditional Access, Intune compliance and privileged identity management
• Experience setting disaster recovery and backup standards and running DR test programmes, including ransomware recovery
• Experience in IT risk and assurance, including risk registers, external IT audits (ITGC/ITAC), access reviews and reporting to Exco, audit and risk committees and group shareholders
• Practical experience with POPIA and PAIA (data subject requests, DPIAs and operator agreements) and with ISO 27001
• Experience managing security budgets, vendor contracts and managed security services (MDR/SOC)
• Strong knowledge of information security principles, controls and regulatory requirements, and of modern security tooling (SIEM, EDR, cloud security posture management and vulnerability management)
• A working understanding of the software development lifecycle and of ITIL incident, change and problem management
• ISP or telecommunications experience is strongly preferred
• Exposure to NIST CSF, CIS Controls or King IV will be advantageous
• Data and scripting skills (for example Python and SQL) for security metrics and reporting automation will be advantageous
• Security certifications such as CISM, CISSP or CRISC, cloud security certifications such as CCSP, AWS Certified Security Specialty or Microsoft Certified: Cybersecurity Architect Expert, ISO 27001 Lead Implementer or Lead Auditor, and privacy or business continuity certifications will be advantageous
• The ability to set strategic direction and a clear roadmap aligned to company strategy, with strong systems thinking
• Strong stakeholder management and communication skills at all levels, including leading change
• Sound, timely decision making under pressure, with strong planning, prioritisation and problem solving skills
• A high level of confidentiality and integrity

What we offer:

• Exposure to a dynamic workplace
• A chance to grow your skills through our internal academy
• A friendly, team-driven environment
• Group Risk Benefits
• Medical Benefits
• Health and Lifestyle Programmes

Important Disclaimer:

• Please ensure that the information you provide in your application is true, accurate, and correct.
• Preference will be given to candidates from Designated Groups, as defined by the Employment Equity Act and in line with Herotel’s Employment Equity Plan.
• By submitting an application, you consent to the processing of your personal information in accordance with POPIA for recruitment purposes. For more details on how we handle personal information, please refer to our Privacy Policy on our website.
• If you do not hear from us within 14 days, please consider your application unsuccessful.