IT Governance, Risk & Compliance Officer

Are you a detail oriented governance and compliance specialist with a passion for information security? Join our Information Systems team as an
IT Governance, Risk & Compliance Officer
in
Plattekloof
, where you'll lead Herotel's ISO 27001 certification programme and own our POPIA compliance obligations.
This role is perfect for someone who thrives on structure, documentation and stakeholder engagement, and who wants to build a governance function from the ground up within a fast growing telecommunications business.

What you'll do:

Lead Herotel's ISO 27001 certification programme, including ISMS scoping, gap and risk assessments, and maintaining the Statement of Applicability
Develop, maintain and drive adoption of the information security policy suite
Maintain the information security risk register and risk treatment plan, tracking remediation with control owners
Plan and execute the ISMS internal audit programme, coordinate management reviews and maintain ISMS records and evidence
Manage the certification body relationship, including Stage 1 and Stage 2 audits, findings closure and ongoing surveillance audit readiness
Coordinate implementation of Annex A controls together with the Cybersecurity Engineer and IT teams
Own POPIA compliance, developing, maintaining and enforcing policies and procedures aligned with legislative requirements
Manage and respond to POPIA related requests and incidents, including data subject access requests, complaints and data breach notifications
Serve as Herotel's Deputy Information Officer under POPIA
Conduct data protection impact assessments for new systems, processes and third party integrations that handle personal information
Run the security awareness and training programme, tracking completion and driving adoption across the organisation
Conduct third party and vendor security and privacy risk assessments, reviewing vendor agreements for security and compliance obligations
Produce the monthly compliance dashboard covering ISMS status, audit findings, POPIA metrics and awareness training
What you'll need:
Diploma or Degree in Information Technology, Information Security, Audit, Law or a related field
3 to 5 years experience in information security governance, risk and compliance, ISMS, or privacy roles
Hands on experience implementing or operating an ISO 27001 ISMS
Working knowledge of POPIA and its practical application in a South African operating context
Proven policy authorship, with experience driving policy adoption and security awareness training
Experience with risk assessment methodologies and maintaining risk registers and treatment plans
Exposure to third party and vendor risk assessment
Sufficient understanding of security technologies such as SIEM, endpoint protection and vulnerability management to define and audit controls
Strong written communication, documentation and stakeholder engagement skills
ISO 27001 Lead Implementer certification is strongly preferred, or willingness to obtain it within the first six months
Participation in certification or surveillance audits is advantageous
Desirable certifications include ISO 27001 Lead Auditor, CISM, CISA, CRISC, CIPP or CIPM
What we offer:
Exposure to a dynamic workplace
A chance to grow your skills through our internal academy
A friendly, team driven environment
Group Risk Benefits
Medical Benefits
Health and Lifestyle Programmes
Important Disclaimer:
Please ensure that the information you provide in your application is true, accurate, and correct.
Preference will be given to candidates from Designated Groups, as defined by the Employment Equity Act and in line with Herotel's Employment Equity Plan.
By submitting an application, you consent to the processing of your personal information in accordance with POPIA for recruitment purposes. For more details on how we handle personal information, please refer to our Privacy Policy on our
website
.
If you do not hear from us within 14 days, please consider your application unsuccessful.