Security jobs in South Africa

Who are we?

Sanlam Group Technology is responsible for the provision of a digitally enabled technology service as a group COE, drive business and transformation and provide group-wide digital and data architecture. We operate the various technology platforms and shared services, ensure Cyber and Information Security resilience, and act as technology governance and risk orchestrator for technology across Sanlam.

• Minimum 7 years of experience in IT security, with at least 5 years focused on Active Directory
• Proven experience in managing and securing multi-domain AD environments
• Experience with AD integration in hybrid cloud environments
• Experience in the technologies involved in networking, firewalls, Windows and Unix/Linux Operating Systems and internet protocols
• Experience with security tools such as Microsoft Entra ID Protection, Checkpoint or FortiGate firewalls and SIEM tools
• Experience with AD migrations, mergers, or restructuring
• Experience with logging systems and log analysis

The Senior Infrastructure Security Engineer will serve as a technical leader and guide as needed on technical efforts initiated by the Cybersecurity, Infrastructure, and Operations teams and projects outside of Security. This role will focus on Infrastructure Security, Identity and Access Management, Cloud Security, and Network Security. The position requires a deep understanding of AD security, firewall management, network security, and operating system security, as well as threat detection, response, and mitigation. Additionally, experience with associated technologies such as Group Policy, DNS, certificate services, InTune, LAPS, VPN, and SIEM is essential.

• Design and manage security configurations for AD environments, including multi-domain forests
• Perform regular security assessments and audits of AD infrastructure
• Develop and enforce security policies related to AD, including password policies, account lockout policies, and privileged access management

• Manage the lifecycle of AD accounts, groups, and organisational units (OUs)
• Implement and manage Role-Based Access Control (RBAC) and least privilege access models

• Coordinate technical response during investigations into infrastructure security-related security incidents, including unauthorised access, privilege escalation, and breaches (primary point of contact for the CSIRT)
• Develop and maintain incident response playbooks related to AD, firewalls, and VPN
• Collaborate with the Security Operations Center (SOC) to detect and respond to AD and other infrastructure threats.
• Implement measures to protect AD against common threats like Pass-the-Hash, Golden Ticket attacks, and Kerberoasting

• Implement disaster recovery solutions for AD, including backup and restore processes
• Plan and coordinate lifecycle and capacity management of the SIEM service (software version upgrades, hardware upgrades and migrations, deployment of new infrastructure)
• Ensuring compliance with regulatory standards, industry best practices, and company policies and standards

• Work closely with cybersecurity, compliance, architecture, and infrastructure & operations teams to align infrastructure security with overall organisational goals
• Provide technical leadership and mentoring to junior engineers and other IT staff.
• Prepare and present reports on AD security posture to senior management and stakeholders
• Timely and accurate communication of project status reports, risks and issues to key stakeholders
• Represent team as senior technical subject matter expert and key decision maker in project meetings and activities; function as a member of the extended central Cyber Security team during weekly progress meetings, ISO Forums; and participate in the annual strategic planning of the central Cyber Security Team
• Contribute to both Cybersecurity and Infrastructure & Operations roadmaps and overviews to key stakeholders and internal customers
• Management and oversight of 3rd party consultants assigned to specific projects
• Manage SIEM service provider
• Coordinate technical efforts in support of new initiatives to improve Cyber resilience in the group

• Matric
• Bachelor’s degree in Computer Science, Information Technology, or a related field. Equivalent experience may be considered
• Certifications such as CISSP, CISM, Microsoft Certified: Identity and Access Administrator Associate, or similar

• Cyber Security Administration
• Cyber Security Audits
• Cyber Security Compliance
• Assessing security risks
• Assessment risk mitigation for the organisation

• Plans and aligns - Contributing through others
• Decision quality - Contributing through others
• Optimises work processes - Contributing through others
• Interpersonal savvy - Contributing through others

We’re all about building strong, lasting relationships with our employees. We know that you have hopes for your future – your career, your personal development and of achieving great things. We pride ourselves in helping our employees to realise their worth. Through its five business clusters – Sanlam Fintech, Sanlam Life and Savings, Sanlam Investment Group, Sanlam Allianz, Santam, as well as MiWay and the Group Office – the group provides many opportunities for growth and development.

• Being resilient - Contributing through others
• Collaborates - Contributing through others
• Cultivates innovation - Contributing through others
• Customer focus - Contributing through others
• Drives results - Contributing through others

The shortlisting process will only start once the application due date has been reached. The time taken to complete this process will depend on how far you progress and the availability of managers.

The Sanlam Group is committed to achieving transformation and embraces diversity. This commitment is what drives us to achieve a diverse, inclusive and equitable workplace as we believe that these are key components to ensuring a thriving and sustainable business in South Africa. The Group's Employment Equity plan and targets will be considered as part of the selection process.