Cyber Security Specialist

Closing Date 2026/09/09

Reference Number WWL260902-4

Job Title Cyber Security Specialist

Job Type Full Time

Business Unit Information Technology

Location - Country South Africa

Location - Province Western Cape

Location - Town / City Cape Town

Location Description Head Office

Minimum Education Level Diploma | Advanced Certificate

Job Advert Summary

At Woolworths we are on a mission to maintain and develop a high-performing cyber and information security function in support of a complex business undergoing digital transformation. We are looking for a passionate Cybersecurity Specialist: Business Information Security to help strengthen security where business and technology meet, influence behaviour and drive practical security improvements.

You’ll be working as part of the Business Information Security (BIS) team to defend Woolworths against cyber threats and information security risks. You will work closely with the rest of the Cyber team, IT GRC, and partners across the Group to continually improve our security posture, plus supporting and transforming our security capabilities by embedding security practices into business practices, third party ecosystems, data handling and workforce behaviours to reduce cyber risk while supporting business objectives.

This role acts as a bridge between cybersecurity and business, translating cyber risk into business risk and enabling secure adoption of technology, data and digital partnerships. The role also requires good people skills to effectively interact and communicate with various stakeholders across Woolworths.

Minimum Requirements

• A relevant tertiary qualification in Information Technology, Computer Science, Cybersecurity, Information Systems, Engineering, or a related discipline.
• A minimum of three (3) years’ relevant experience in cybersecurity, information security, or a closely related role.
• Demonstrable hands-on technical capability in implementing, configuring, operating, assessing, or supporting cybersecurity technologies and controls.
• Practical experience across multiple security domains, including identity and access management, data security and protection, third-party risk management, security awareness and culture, vulnerability management, and infrastructure security across network, cloud, platform, and endpoint environments.
• Strong working knowledge of cybersecurity principles, security architecture, technical control design, risk management practices, and commonly adopted security frameworks, standards, control libraries, and tools.
• Ability to interpret technical security findings, assess associated business risks, identify control gaps, and recommend practical remediation actions.
• Experience working with technical teams to investigate security issues, troubleshoot control-related challenges, and support the implementation and continuous improvement of security solutions and processes.
• Strong stakeholder engagement, communication, and interpersonal skills, with the ability to communicate technical security matters clearly to both technical and non-technical audiences while maintaining professionalism.
• Ability to work collaboratively across business, technology, risk, assurance, and third-party teams and to influence security outcomes without relying solely on direct authority.
• Evidence of active engagement with, and contribution to, the broader information security community through professional networks, knowledge sharing, industry events, research, mentoring, or similar activities.

Advantageous

• Relevant qualifications and certifications such as ISO27001, CompTIA Security+, CISM, CISSP or similar certification is highly advantageous.
• Knowledge of recognised frameworks and standards, including ISO/IEC 27001, NIST Cybersecurity Framework, CIS Critical Security Controls, COBIT and PCI DSS.
• Experience working in environments with federated technology ownership, multiple business units, outsourced service providers and diverse application landscapes.
• Experience within a large, complex or distributed enterprise environment—preferably retail, financial services or another highly regulated industry.

Additional Criteria

• May be required to assist outside of working hours.
• Working knowledge of PCI-DSS.
• Presents problem analysis and a recommended solution rather than just identifying and describing the problem itself
• Demonstrates a results-oriented mindset in planning and implementing activities/projects.
• Monitors and tracks progress to ensure delivery of all planned commitments, and keeps the appropriate people informed
• Prepares written reports and briefs and communicates ideas clearly
• Speaks fluently in team meetings when presenting information
• Manages existing partnerships within established agreements or contracts; negotiates adjustments when mutually beneficial to do so
• Genuinely cultivates personal bonds with colleagues to enhance performance throughout the organisation
• Adjusts to work effectively within new work structures, processes, requirements, or cultures
• Demonstrates resourcefulness in acquiring necessary knowledge, skills, and competencies to adapt to change

Duties and Responsibilities

• Identity and Access Management (IAM): Strengthen identity governance by supporting user access reviews and certifications, promoting the adoption of IAM standards and controls, and enabling the effective operation and continuous improvement of IAM and Privileged Access Management (PAM) processes across the business.
• Security Awareness and Culture: Plan and deliver engaging security awareness initiatives, support security culture transformation programmes, and coordinate security champion networks in partnership with business teams.
• Data Security and Protection: Support the implementation, operation and continuous improvement of data protection controls and technologies, including Data Loss Prevention (DLP) and Cloud Access Security Broker (CASB) solutions. Investigate data security alerts, identify potential control gaps and coordinate appropriate response and remediation actions.
• Third-Party and Ecosystem Security: Conduct, review and track security assessments of vendors, service providers and business partners. Identify security risks and control deficiencies, monitor remediation commitments, and support the management of cyber risk across the broader third-party ecosystem.
• Business Security Advisory and Risk: Serve as a trusted security advisor to business units by providing practical, risk-based guidance on projects, technology changes, business processes and emerging security concerns. Translate technical security risks into clear business impact and actionable recommendations.
• Governance, Risk and Compliance: Support the implementation and maintenance of cybersecurity policies, standards, procedures and control frameworks. Assist with regulatory, audit, compliance and assurance activities, including evidence gathering, control assessments, finding remediation and progress tracking.
• Vulnerability Management: Support the identification, validation, prioritisation and tracking of vulnerabilities. Coordinate remediation activities with infrastructure, application, cloud and other technical teams, and help stakeholders understand the associated business risks and required remediation actions.
• Security Technology Operations and Enhancement: Maintain, administer and enhance existing and new cybersecurity technologies required to improve the organisation’s security posture and active defence capabilities, including DLP, CASB, IAM, PAM and related security platforms.
• Security Investigation and Incident Support: Support the investigation, escalation and reporting of security events and incidents. Provide relevant business, data and risk context, coordinate wit