IT Security Governance and Policy Specialist

Location: Gauteng

Positions Available: 5

Salary: Market-related

Employment type: 3 Year contract, hybrid

We are seeking experienced and highly skilled IT Security Governance and Policy Specialists to support the development, implementation, maintenance and continuous improvement of information security governance frameworks, policies, standards and procedures within complex enterprise IT environments.

The successful candidates will be responsible for ensuring that information security practices align with organisational objectives, regulatory requirements, industry standards and recognised cybersecurity governance frameworks.

This role requires strong expertise in IT governance, risk management, regulatory compliance, information security policy development and cybersecurity assurance.

The ideal candidates will have proven experience working within structured enterprise environments, with the ability to translate security requirements into practical governance policies, controls and compliance processes.

• Develop, implement, review and maintain information security policies, standards, procedures and governance frameworks.
• Ensure security policies align with organisational objectives, regulatory requirements and recognised industry standards.
• Establish and maintain information security governance structures, processes and control frameworks.
• Review existing security policies and recommend improvements to strengthen organisational security.
• Support the development and implementation of enterprise information security strategies.
• Define security governance responsibilities, accountability structures and reporting requirements.
• Ensure policies and standards remain relevant to emerging cybersecurity risks and evolving technology environments.

• Conduct information security risk assessments and identify governance, risk and compliance gaps.
• Develop and maintain information security risk registers and risk treatment plans.
• Monitor compliance with approved security policies, procedures and regulatory obligations.
• Support compliance with POPIA, ISO 27001, NIST and other applicable security requirements.
• Assess the effectiveness of information security controls and recommend corrective actions.
• Assist with third-party and supplier security risk assessments.
• Monitor emerging regulatory developments and evaluate their implications for information security governance.
• Coordinate remediation activities arising from compliance assessments and security audits.

• Support internal and external information security audits.
• Coordinate the collection and maintenance of audit evidence and compliance documentation.
• Review security control effectiveness and identify opportunities for improvement.
• Track audit findings, corrective actions and remediation progress.
• Assist with security control testing and governance maturity assessments.
• Prepare governance reports, risk assessments and compliance updates for management.
• Support the implementation and ongoing maintenance of information security management systems.

• Collaborate with cybersecurity, infrastructure, application, risk, compliance and business teams.
• Provide guidance on information security policies, standards and governance requirements.
• Assist with information security awareness and compliance initiatives.
• Support management in understanding information security risks and regulatory obligations.
• Participate in governance committees, security reviews and risk management discussions.
• Promote consistent adoption of security policies across the organisation.

• Relevant diploma or degree in Information Technology, Information Systems, Computer Science, Cybersecurity, Risk Management or a related discipline.
• Typically 3–5 years of relevant experience in IT security governance, information security risk management, IT compliance or cybersecurity GRC.
• Proven experience developing, implementing or maintaining information security policies and standards.
• Strong understanding of information security governance principles and enterprise risk management.
• Practical experience working with information security frameworks such as ISO/IEC 27001, NIST or COBIT.
• Knowledge of information security risk assessment methodologies and control frameworks.
• Experience conducting compliance assessments, governance reviews or security control…