IT & OT Supplier Governance Specialist

ROLE PURPOSE

The IT & OT Supplier Governance Specialist is accountable for the commercial, contractual, and operational integrity of Service Provider suppliers and subcontractors delivering into IT and OT environments under the SDM's client portfolio. This role exists because supplier-delivered service is still Nexio's accountability — a failure, breach, or governance gap at a subcontractor is a failure at Nexio, not a pass-through risk. The role owns supplier performance against contracted terms, not supplier relationship management for its own sake. It converges IT and OT supplier governance into a single accountability point, closing the gap where OT vendors (network, infrastructure, industrial/operational systems) are often governed less rigorously than IT vendors — despite carrying equal or greater client, safety, and compliance exposure.

What This Role Owns (Outcome Commitments):

• Supplier Performance & Compliance — Service Provider and subcontractor delivery measured against SLA, contractual, and regulatory obligations across both IT and OT environments — not assumed, verified.
• Risk Containment a— Identification of supplier-originated risk (security, compliance, delivery, financial stability) before it surfaces as a client-facing incident or escalation.
• Contractual & Commercial Integrity — Supplier contracts, SLAs, and pricing terms actively governed and reconciled against what was sold to the client.
• OT-Specific Governance — Application of appropriate governance rigour to operational technology suppliers (industrial systems, network infrastructure, critical operational environments), where consequences of failure differ materially from standard IT service failure.
• Audit & Evidence Trail — Maintenance of governance documentation sufficient to withstand client, regulatory, and internal audit scrutiny — evidence of control, not evidence of activity.

What Success Looks Like:

Every supplier within scope is governed against a current, reconciled contract; no supplier-originated risk reaches the client as a surprise; and audit or client scrutiny of the supply chain finds a defensible, documented governance trail rather than informal relationship management.

ROLE ACCOUNTABILITIES / KEY ACTIVITIES

• Supplier Contract & Commercial Governance

Accountable for: Ensuring every in-scope supplier is governed against a current, reconciled contract including Nexio services — not legacy terms or informal arrangements.

• Maintain a live supplier register per client environment, mapping each supplier to the contract clauses, SLAs, and commercial terms they are bound by

• Reconcile supplier pricing and terms against what was commercially sold to the client — flag margin exposure introduced by supplier cost creep or scope drift

• Validate that subcontracted OT suppliers carry terms appropriate to operational/critical environments, not generic IT boilerplate

• Supplier Performance & SLA Compliance

Accountable for: Verified — not assumed — supplier delivery against contracted commitments across IT and OT scope.

• Track supplier performance against SLA/SLO commitments, distinguishing IT service metrics (availability, MTTR) from OT-specific metrics (uptime of industrial/network systems, safety-critical response times)

• Conduct scheduled and ad hoc supplier performance reviews; document underperformance formally, not informally, with a clear remediation trail

• Escalate persistent supplier non-performance through formal contractual mechanisms (penalty clauses, escalation triggers) rather than absorbing the gap operationally

• Feed supplier performance data into the SDM's client-facing service health reporting — supplier risk must be visible at the account level, not siloed

• Risk & Compliance Management at the Supply Chain Boundary

Accountable for: Identifying and containing supplier-originated risk before it becomes a client-facing incident.

• Maintain a supplier risk register, classified explicitly as confirmed risk, assumption, or contained/mitigated — consistent with departmental risk discipline

• Assess supplier security posture and compliance status (data handling, POPIA where applicable, industry-specific regulatory requirements for OT/critical infrastructure)

• Apply differentiated risk treatment to OT suppliers where failure consequences extend beyond service disruption (e.g. safety, regulatory, critical infrastructure exposure)

• Coordinate supplier-side root cause analysis when a supplier failure contributes to a Major Incident, ensuring findings feed back into contract and governance terms

• Governance Framework & Standardisation

Accountable for: A consistent governance approach across a supplier base that spans IT and OT, avoiding fragmented or ad hoc oversight.

• Apply ITIL 4 Supplier Management practice consistently across all in-scope suppliers, adapted for OT-specific operating realities where standard IT process doesn't translate

• Standardise supplier onboarding, offboarding, and periodic re-assessment processes — controlled consistency, not one-off arrangements per supplier

• Maintain governance documentation to a standard that withstands client, regulatory, and internal audit without remediation

• Identify where supplier governance gaps exist structurally (e.g. OT suppliers historically under-governed relative to IT) and drive closure of those gaps

• Stakeholder Coordination & Escalation

Accountable for: Ensuring supplier-related risk and performance issues are visible to the right stakeholders before they surface as surprises.

• Provide the SDM with supplier governance input for client service reviews — health, risk, and compliance status, not raw supplier activity logs
• Coordinate with Commercial/Sales where supplier terms intersect with client-facing commercial commitments, ensuring no conflict between what was sold and what suppliers are contracted to deliver
• Escalate supplier financial stability or delivery-capability concerns early — before they manifest as a client-facing service failure
• Support incident and major incident processes where supplier involvement requires coordinated response across Nexio and Service Provider teams

COMPETENCIES (KNOWLEDGE, SKILLS AND ATTRIBUTES)

Technical & Domain Competencies

• Supplier / Vendor Management Discipline — Structured application of formal supplier governance methodology (contract management, performance measurement, risk assessment) — not relationship management by default
• ITIL 4 Supplier Management Practice — Working fluency in supplier management as a formal ITIL practice, integrated with Incident, Problem, and Change processes
• OT/IT Convergence Understanding — Ability to distinguish and correctly apply governance rigour across IT service suppliers and OT/industrial/critical infrastructure suppliers, recognising that failure consequences differ materially between the two
• Contract & Commercial Literacy — Ability to read, interpret, and reconcile supplier contracts against client-facing commercial terms; identify margin exposure and scope drift introduced upstream
• Risk & Compliance Acumen — Working knowledge of regulatory and compliance considerations relevant to critical infrastructure, industrial systems, and data handling (POPIA and sector-specific requirements where applicable)
• Governance & Audit Readiness — Ability to build and maintain documentation and evidence trails that withstand client, regulatory, and internal audit scrutiny without remediation

Analytical & Judgement Competencies

• Separation of Fact, Assumption, and Risk — Consistently distinguishes verified supplier performance from assumed or self-reported performance; never presents supplier "evidence of activity" as "evidence of control"
• Structural Risk Identification — Identifies systemic governance gaps (e.g. OT suppliers historically under-governed relative to IT