|
I. JOB DESCRIPTION
|
|
Links to structures
|
|
Job function*
|
Manager, IT Security
|
|
Job family*
|
Information Technology
|
|
Job reports to*
|
Chief Information Officer (Country)
|
|
Career type*
|
Functional/Specialist
|
|
Contribution
|
|
|
Job purpose description*
|
Information Security manager is in charge of the Information Security Management function, providing line management, leadership and strategic direction for the function and liaising closely with other managers. The purpose of the Information Security Management function, in turn, is to bring the organization’s information security risks under explicit management control through the Information Security Management System.
|
|
Job criticality
|
Strategically Critical
|
|
Key responsibilities*
|
|
Output group 1*
|
Routine line management and leadership of staff within the Information Security Management function
|
|
Key Activities (what and how)
|
- Leadership and strategic direction for the function, ranging from planning and budgeting to motivational and promotional activities expounding the value of information security
- Recruitment, leadership and direction for a loose network of information security ambassadors distributed throughout the organization
|
|
Output group 2*
|
Leads the design, implementation, operation and maintenance of the Information Security Management System based on the ISO/IEC 27001 Standard.
|
|
Key Activities (what and how)
|
- Forms a “centre of excellence” for information security management, for example offering internal management consultancy advice and practical assistance on information security risk and control matters throughout the organization and promoting the commercial advantages of managing information security risks more efficiently and effectively
|
|
Output group 3
|
Liaison with and offers strategic direction to related governance functions (such as Physical Security/Facilities, Risk Management, IT, HR, Legal and Compliance) plus senior and middle managers throughout the organization as necessary, on information security matters such as routine security activities plus emerging security risks and control technologies
|
|
Key Activities (what and how)
|
- Leads or commissions the preparation and authorizes the implementation of necessary information security policies, standards, procedures and guidelines, in conjunction with the Security Committee
- Leads the design and operation of related compliance monitoring and improvement activities to ensure compliance both with internal security policies etc. and applicable laws and regulations
- Leads or commissions suitable information security awareness, training and educational activities
- Leads or commissions information security risk assessments and controls selection activities
- Leads or commissions activities relating to contingency planning, business continuity management and IT disaster recovery in conjunction with relevant functions and third parties
|
|
II. REQUIREMENTS
|
|
Qualifications
|
|
|
Formal minimum qualification 1*
|
Type of qualification: First Degree
Field of study: IT and Computer Sciences
|
|
Other qualifications, certifications or professional memberships
|
Minimum of first degree or its equivalent in numerate or semi-numerate disciplines such as engineering, computer sciences, statistics, mathematics.
Information security management qualifications such as CISSP or CISM
|
|
Preferred
|
|
|
Preferred qualification 1
|
Type of qualification: Masters Degree
Field of study: Generic Management
|
|
Experience
|
|
|
Experience required 1*
|
JobFunction: Information Technology
Job Family:IT Operations
Years: 5-7 Years
Experience Description:Work experience in information security management and/or related functions (such as IT audit and IT Risk Management) with a background in technical IT roles such as IT architecture, development or operations, with a clear and abiding interest in information security
|
|
Behavioural Competencies
|
|
Behavioural competency 1*
|
Competency Label: Making Decisions
Competency Description:This competency is about the pace at which individuals are prepared to make decisions, as well as their willingness to take responsibility for their decisions when under pressure. It also deals with the extent to which individuals are definite about their views and opinions.
|
|
Behavioural competency 2*
|
Competency Label: Pursuing Goals
Competency Description:The behaviours related to “Pursuing Goals” include the extent to which individuals are ambitious, are driven to achieve results and are persevering in the face of adversity.
|
|
Behavioural competency 3
|
Competency Label: Meeting Timescales
Competency Description:This competency involves individuals adhering to time scales and meeting deadlines. The focus is therefore on being reliable at completing tasks and being punctual.
|
|
Behavioural competency 4
|
Competency Label: Generating Ideas
Competency Description:The greater the number of alternative ideas or solutions generated, the greater the probability of finding a good solution. This competency is about how fluent an individual is at generating ideas, the number of ideas they generate and how confident they are in their ability to generate unusual ideas or favour radical solutions. This is further enhanced by the extent to which an individual enjoys the creative process.
|
|
Behavioural competency 5
|
Competency Label: Resolving Conflict
Competency Description:This competency is about effectively dealing with disagreements and conflict in the workplace. In order to demonstrate being competent at resolving conflicts in the workplace, individuals are expected to demonstrate that they are able to effectively handle angry individuals and emotionally charged situations.
|
|
Technical Competencies
|
|
Technical competency 1*
|
Competency Label:Development
Competency Description:The design, creation, testing and documenting of new and amended programs from supplied specifications in accordance with agreed standards.
Proficiency Level: SEASONED - Applies concepts without requiring supervision, able to provide technical guidance when required
|
|
Technical competency 2*
|
Competency Label: Emerging technology monitoring
Competency Description:The identification of new and emerging hardware, software and communication technologies, products, methods and techniques and the assessment of their relevance and potential value to the organization. The promotion of emerging technology awareness among staff and business management.
Proficiency Level: EXPERT - Provides leadership in this field both within the organisation and in the larger industry
|
|
Technical competency 3
|
Competency Label:Technology Orientation
Competency Description:The understanding of broad areas that form technology landscape and how they complement each other in for specific IT solutions or decisions. This would comprise of, but not limited to, the following: BI, CRM, ERP, Database, Open Source, Web 2.0.
Proficiency Level: SEASONED - Applies concepts without requiring supervision, able to provide technical guidance when required
|
|
Technical competency 4
|
Competency Label:Information Security
Competency Description:The management of, and provision of expert advice on, the selection, design, justification, implementation and operation of information security controls and management strategies to maintain the confidentiality, integrity, availability, accountability and relevant compliance of information systems.
Proficiency Level: EXPERT - Provides leadership in this field both within the organisation and in the larger industry
|
|
Technical competency 5
|
Competency Label:IT Systems
Competency Description:Knowledge and understanding of various IT systems and related configurations as applied within a specified business environment.
Proficiency Level: EXPERT - Provides leadership in this field both within the organisation and in the larger industry
|
|
Technical competency 6
|
Competency Label:IT Knowledge
Competency Description:Possesses a deep and broad knowledge base in fundamental IT technical skill sets. Stays informed on emerging trends.
Proficiency Level: EXPERT - Provides leadership in this field both within the organisation and in the larger industry
|
|
Leadership Competencies
|
|
Leadership Competency 1
|
Competency Label: Purposeful Collaboration
Competency Description: Understands and leverages the dependencies across the organisation and the impact of own actions on the rest of the organisation to create organisation alignment for decision-making and delivery of quality outcomes.
Proficiency Level Description:Puts others' success first when it's relevant for the organisation; is invested in others' success. Actively and explicitly supports other functions. Has the ability to re-prioritise (even at the cost of own function's performance) when the best for the organisation is to support another function.
|
|
Leadership Competency 2
|
Competency Label: Aligning Business to Strategy
Competency Description:Understands the line-of-sight between strategy and organisational implementation. Translates the organisational strategy into specific decisions and actions to ensure the strategy implementation. Aligns resources to effectively execute against the strategic direction.
Proficiency Level Description:Recognises interdependencies, connections and underlying patterns between different systems, trends, opportunities and threats in order to develop the optimum strategic response. Takes a long term, macro view on strategy. Makes strategic choices, sequencing and prioritising actions to implement longer-term strategy.
|
|
Leadership Competency 3
|
Competency Label: Driving Delivery of Results
Competency Description:Proactively identifies business opportunities or barriers to business performance and addresses them. Takes accountability for improving the business. Demonstrates a sense of urgency around the achievement of stretching business goals.
Proficiency Level Description:Identifies and implements a business opportunity that will have a long-term impact on the business (which may include the organisation's reputation or brand image). Makes decisions, sets priorities, or chooses goals on the basis of inputs and outputs: makes explicit considerations of potential profit, return on investment, or cost benefit analysis. Based on the cost benefit analysis, makes decisions of entrepreneurial risk nature.
|
|
Additional Job Dimensions
|
|
Business accountability: Impact on end result*
|
Primary - Has a controlling impact on end results
|
|
Typical direct reports for this job*
|
Job Title:Security Operations Centre Analyst
Number: 1-3
Job Title:IT Security Analyst
Number: 1-3
|
|
Internal relationships*
|
Business area:Operational Risk and Compliance Committee
Nature of relationship: Provide a service to them
Sphere of influence: Impact the whole Group
Business area:IT Steering Commitee
Nature of relationship: Provide a service to them
Sphere of influence: Impact the whole Group
Business area:Finance
Nature of relationship: Provide and receive a service
Sphere of influence: Impact the whole business unit
Business area:IT team leaders
Nature of relationship: Influence their service delivery
Sphere of influence: Limited to their department only
Business area:Business units (PBB, CIB, GEFs)
Nature of relationship: Provide a service to them
Sphere of influence: Impact the whole Group
Business area:Matrix partners in Standard Bank Group
Nature of relationship: Provide a service to them
Sphere of influence: Impact the whole Group
|
|
External relationships*
|
Role type of external contact: IT Vendors
Nature of relationship: Manage the relationship
Role type of external contact: Regulators
Nature of relationship: Manage the relationship
|
