Information Security Officer

Hybrid - 2 days per week in the Vitality Sandton Office. Full time, 37.5 hours per week.

• Extensive security governance expertise
• Proven information risk management
• Strong regulatory compliance knowledge

This role is responsible for leading and strengthening the information security governance framework across Vitality, ensuring information assets are protected and regulatory obligations are met. Working closely with the Governance Lead and teams across the business, the Information Security Officer will maintain the ISMS, oversee ISO 27001 and multi-market compliance, manage information security risk and support the delivery of the wider Information Security Strategy.

The role will also provide security oversight across suppliers, projects and the software development lifecycle, while driving effective policies, assurance activity and security awareness. Based in Johannesburg, the position may require occasional travel to UK sites.

• Lead the continuous improvement and maintenance of the Information Security Management System, supporting ISO 27001 and multi-market compliance across the Vitality Group
• Manage the information security governance framework and ensure security risks are identified, assessed, reported and addressed in line with business and regulatory requirements
• Deliver key information security initiatives and projects that support the Information Security Strategy and strengthen the organisation’s overall security position
• Provide security oversight across projects and development activity, including the SDLC, Agile delivery processes and Data Protection Impact Assessments
• Assess and manage supplier security risks in partnership with Cyber Security Operations and relevant internal stakeholders
• Develop and maintain information security policies, standards, procedures and guidance that provide clear and consistent controls across the business
• Plan and deliver compliance reviews, identify control gaps and work with stakeholders to ensure appropriate remedial action is completed
• Produce clear governance and risk reporting for the Information Governance Steering Group, Information Asset Owners and Senior Information Risk Owner
• Develop and deliver security awareness and training activity that improves understanding and promotes secure working practices across the organisation
• Monitor emerging security threats, regulatory developments, industry standards and security technologies to inform future governance priorities and business planning

• A minimum of seven years’ experience working within information security
• A degree or equivalent professional security qualification, with certifications such as CISSP, CISM, CISA or an equivalent credential
• Strong experience managing ISO 27001 and other security governance frameworks, including ISO 27002, PCI DSS or NIST
• Practical experience of information security risk management, supplier security assessments and regulatory compliance
• Knowledge of relevant data protection and regulatory requirements, including GDPR, FCA, ICO and PRA expectations
• Experience providing security oversight throughout the software development lifecycle and within Agile delivery environments
• Excellent written and verbal communication skills, with the ability to explain technical security matters to non-technical audiences
• Strong experience producing policies, standards, governance reports, audit documentation and project materials
• The ability to work independently, solve complex problems and manage competing priorities accurately under pressure
• Experience with in insurance,…