Cyber Security Risk Analyst - BSTD

The successful candidate will be responsible for the following key performance areas:

• To plan and prioritise information and cyber security risk assessments across the group.
• To collect and compile all needed business area function, process and technical risk information to appropriately scope and plan for all assessments.
• To identify the information assets across the group and rate the potential impact related to the breach of confidentiality, integrity or availability whilst integrating with the business continuity impact rating process as far as possible.
• To integrate with the threat assessment process by working with the Threat Analyst to ensure an appropriate threat landscape for use in the business risk process.
• To assist the threat analyst in identifying and rating vulnerabilities and controls related to threats.
• To identify applicable risks and deriving the residual likelihood of success and business impact rating through facilitating discussion with the subject matter experts and applicable business areas.
• To maintain and report on the SARB Risk Universe through thorough, concise and reliable risk assessment reports, including risk mitigation plans for departments.
• To stay abreast of theoretical and applied developments in the field of information security risk management and analyse the implications of these changes for the work of the department and make specific proposals on how these developments might be applied to improve current practices.
• To engage with stakeholders across the SARB group at different levels of seniority, displaying the ability to solicit information as well as convey and explain information fluently. 

Qualifications

Job requirements

To be considered for this position, candidates must be in possession of:

• minimum of a Bachelor Degree (NQF 7) in Security/Information Technology/ OR equivalent 
• a minimum of 5-7 years of experience in an Information Technology environment, of which 2 years within an Security Risk environment 

The following would be an added advantage:

• An industry related Security Certification would be an added advantage (e.g. CRISC, CISM, CISA, CISSP)

Additional requirements include:

• Knowledge and experience using the ISF Risk Management Framework
• Leading information security best practice 
• Relevant Legislation
• Information Risk Trends
• Service & Stakeholder focus
• Effective Communication
• Impact & influence Drive for results
• Learning Focus
• Problem Solving and Analysis
• Teamwork
• Planning & organising
• Attention to detail