SPECIALIST: ICT, RISK AND COMPLIANCE

The successful candidate will be expected to perform the following duties and responsibilities:

ICT Assurance and Compliance Monitoring.

• Coordinate ICT internal and external audits.
• Coordinate audit management responses and evidence submissions.
• Monitor implementation of ICT audit recommendations and corrective actions.
• Conduct compliance reviews against approved ICT policies, standards and procedures, excluding specialist identity, endpoint and third-party assurance reviews covered under separate KPAs.
• Report audit and compliance trends, control weaknesses and remediation status to management.

ICT Governance Framework

• Develop, implement and maintain ICTgovernance frameworks to support effectiveICT oversight and decision-making.
• Develop, review and maintain ICT security policies, standards, procedures and guidelines.
• Maintain the ICT policy and governance artefact register in line with approved review cycles.
• Ensure ICT governance alignment with theCorporate Governance of ICT PolicyFramework (CGICTPF) and relevantstandards.
• Advise stakeholders on governancerequirements for embedding ICT controls intobusiness processes.

Third-party risk and assurance

• Review third-party ICT security assurancesduring onboarding, contract renewal ormaterial service changes.
• Coordinate supplier ICT security, privacy andcompliance reviews.
• Track third-party ICT risk issues, control gapsand supplier remediation actions.
• Monitor applicable ICT security SLA andassurance obligations related to suppliers.

ICT Risk Management.

• Develop and maintain the ICT risk management process and ICT risk register.
• Facilitate ICT risk assessments across relevant ICT domains and initiatives.
• Develop and coordinate risk mitigation strategies and treatment plans for identified ICT risks.
• Monitor implementation of ICT risk treatment actions and escalate overdue or high-risk items.
• Support enterprise risk reporting by providing ICT risk inputs and status updates.

ICT Security, Identity and Endpoint Control Monitoring

• Support the monitoring of identity and access management controls, including user access reviews, privileged access and account lifecycle processes.
• Coordinate basic endpoint security compliance checks against approved ICT security standards and baseline requirements.
• Track and report exceptions relating to access control, endpoint protection, patching, malware protection and device configuration compliance.
• Escalate identified ICT security control weaknesses for remediation and management reporting.

ICT Governance Stakeholder Engagement and Reporting

• Coordinate and consolidate ICT governance, risk, compliance and security inputs for management and governance structures.
• Coordinate submission of ICT Steering Committee, Internal Audit Committee and Audit and Risk
• Committee reports.
• Facilitate stakeholder engagements on ICT governance, risk, compliance and security matters.
• Track committee decisions, stakeholder inputs and cross-functional commitments until closure.
• Maintain consistent stakeholder communication on ICT governance matters without duplicating technical ownership assigned to other KPAs.

Minimum Requirements

Minimum Qualifications:

• Grade 12 (Matric)
• Undergraduate qualification at NQF 7 as recognised by SAQA in

Computer Science, Information Technology, Information Security or equivalent.

• Certified Information Systems Auditor (CISA) certification is advantageous.

Minimum Experience

• 5 years relevant work experience in ICT Governance, Risk and Compliance, or IT Security

Knowledge

• ISO/IEC 27001, ISO/IEC 27002, ISO 31000
• COBIT, ITIL
• Corporate Governance of ICT Policy Framework
• ICT Governance structures
• Minimum Information Security Standards (MISS)
• Enterprise-wide Risk Management
• Information Technology Policies
• Policy Development
• IT Risk Management
• IT Governance

Other requirements:

• Flexibility in working hours will be required to meet demands of the role.
• May be required to work overtime.
• Valid driver’s License

The BMA is an equal opportunity employer committed to employment equity and workforce diversity. Preference may be given to suitably qualified candidates from designated groups in line with the BMA employment equity plan. The BMA reserves the right not to make an appointment to the advertised positions.

• It is the applicant’s responsibility to have all foreign qualifications evaluated by South African Qualification Authority (SAQA) and to confirm the appropriate NQF level and to provide proof of such evaluation report.
• Shortlisted candidates may be subjected to an interview and technical assessment(s) (which assesses the candidate's demonstrated professional and technical competency against the job requirements and duties).
• Candidates potentially considered suitable after the interview and technical test(s) for senior positions, will be subjected to a competency assessment(which tests the candidate's demonstrated proficiency in the professional dimensions attached to the level of the post);
• Employment suitability checks will be conducted on the shortlisted candidates (credit, criminal, citizenship, employment references and qualification verifications);
• Appointments will be subjected to a mandatory vetting/security clearance appropriate to the level of the position.

Closing date: 21 October 2026