Manager: ISGRC

Manager: ISGRC

Operating Division: Transnet Pipelines

Employee Group: Permanent

Department: ICT

Location: Durban Central

Reporting To: Head: ICT

Grade: E

Reference: req5835

The closing date is on 18/09/2026. It is the responsibility of the applicant to ensure that HR has received the application before the closing date of the advertisement.

Position Purpose

The position holder must lead the design and provide assurance to the CIO on the

sustainability of IT general controls, information and technology risks, security of information

assets and regulatory compliance (i.e., King IV, etc.) COBIT.

The position holder must advocate Information Security, IT risk and compliance to the

relevant laws and regulations, to Transnet employees as well as to senior management, to

ensure risks relating to the above are mitigated. (e.g., reputational, and non-compliance).

The position focuses on the provision of leadership and direction in the area of IT Risk,

Information Security, IT Governance, and IT Compliance across TPL.

The role develops and implements a comprehensive, enterprise-wide Information Security,

Governance, Risk and Compliance (ISGRC) strategy aligned to TPL’s business objectives,

industry best practice and applicable regulations/standards (COBIT, ITIL, ISO/IEC 27001).

Accountable for TPL-wide cyber incident response: establishing, maintaining and leading the

emergency response plan for cyber breaches, coordinating multi-disciplinary teams during

incidents, and ensuring rapid containment, recovery and post-incident improvement.

Drives a culture of information security awareness through targeted training, campaigns and

leadership engagement across all levels of the organisation. Position Outputs

IT GOVERNANCE, RISK & COMPLIANCE 1. Governance/Strategy • Develop and maintain an ISGRC strategy that aligns to organisational goals and regulatory requirements; translate strategy into multi-year roadmaps and annual plans. • Establish and maintain governance frameworks that ensure accountability, transparency and integrity of security and compliance initiatives across TPL. • Review current and proposed information systems for compliance with the organisation's obligations (including legislation, regulatory, contractual, and agreed standards/policies) and adherence to overall strategy. • Provide advice to those accountable for governance to correct compliance issues. • Define KPIs/metrics for ISGRC effectiveness (e.g., audit closure, vulnerability SLAs, phishing risk, MTTR); report to executive committees and relevant governance forums.

2. Risk Management • Conduct regular, formal risk assessments across information assets; define and implement risk mitigation strategies and track closure to tolerance levels set by executive management. • Maintain the IT risk register within the approved risk management system. • Carry out risk assessment within a defined functional or technical area of business. • Use consistent processes for identifying potential risk events, quantifying and documenting the probability of occurrence and the impact on the business. • Refer to domain experts for guidance on specialised areas of risk, such as architecture and environment. • Co-ordinate the development of countermeasures and contingency plans. • Research and advise on risks related to new and existing technologies. • Third-party/vendor security risk management: define due-diligence processes, assess supplier risks and ensure contractual controls and ongoing monitoring.

3. Manage Regulatory and Internal Compliance • Manage the organisation’s IT regulatory universe. • Carry out regulatory and compliance risk assessment of relevant ICT laws and regulations. • Use consistent processes for identifying potential regulatory and legal risk events, quantifying and documenting the probability of occurrence and the impact on the business. • Refer to domain experts for guidance on specialised areas of regulatory and legal risk, such as legal and regulatory compliance. • Co-ordinate the development of compliance control plans. • Manage the IT audit function by liaising with internal and external audit

• Provide a consulting service to TPL IT functional areas on compliance matters (regulatory universe, compliance control plans), risk framework, and IT policies. • Ensure adherence to standards where appropriate (for e.g., ITIL, COBIT, ISO, etc.) • Prepare and submit compliance and assurance reports to regulatory bodies and auditors, evidencing conformity with applicable standards/frameworks.

4. Manage Business Continuity and Disaster Recovery • Implement and contribute to the development of a continuity management plan. • Coordinate the assessment of risks to the availability, integrity and confidentiality of systems that support critical business processes. • Coordinate the planning, designing, and testing of maintenance procedures and contingency plans. • Lead and manage the organisation’s IT BCM and DR strategy

INFORMATION SECURITY

1. Information and Cyber Security Strategy • Define, present, and promote an information security policy for approval by the senior management of the organisation. • Own (not just implement) the development, review and continuous improvement of security policies, procedures and standards; ensure enforcement across the environment. • Apply relevant standards, best practices and legal requirements for information security.

2. Manage Information Security • Evaluate security management measures and indicators and decides if compliant to information security policy. • Investigate and instigate remedial measures to address any security breaches. • Provide guidance in defining access rights and privileges. Investigate security breaches in accordance with established procedures and recommend required actions and support/follow up to ensure these are implemented. • Serve as a security expert in application development, database design, network, and/or platform (operating systems) efforts, helping project teams comply with enterprise and IT security policies, industry regulations, and best practices. • Research and advocate new technologies, architectures, and security products that will support security requirements for the enterprise and its customers.

• Work with the IT team to ensure adequate security solutions are in place throughout all IT systems and platforms. • Establish relationships with key external information security bodies to stay abreast with information security matters in industry and how these could impact the organisation.

3. Implement SIEM (Security Information & Event Management) • Contribute to the development of policies, standards, processes, and guidelines for the SIEM solution. • Analyse and prioritise security incidents in line with the security incidents management policy. • Investigate and instigate remedial measures to address any security incidents.

4. Manage Threat Protection • Coordinate and manage the planning of penetration tests. • Deliver objective insights into the existence of vulnerabilities, the effectiveness of defences and mitigating controls - both those already in place and those planned for future implementation. • Take responsibility for integrity of testing activities and coordinates the execution of these activities. • Provide authoritative advice and guidance on the planning and execution of vulnerability tests. • Define and communicates the test strategy. • Manage all test processes and contribute to corporate security testing standards.

5. Manage data/information security which includes data loss prevention and encryption • Provide advice and guidance on security strategies to manage identified risks and ensure adoption and adherence to standards. • Obtain and act on vulnerability information and conduct security risk assessments, business impact analysis and accreditatio