Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 4 hours ago

Head of Information Security & Risk

Herotel35 open roles

Where
Plattekloof, South Africa
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowHead of Information Security & RiskHerotel · Plattekloof, South Africa

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on Herotel's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

13.5% of postings close within 7 days. Measured by our own scanner across the market. Herotel postings stay open a median of 8 days.

Share of postings closed within
  1. 2.3%1 day
  2. 4.6%3 days
  3. 13.5%7 days
  4. 21.8%14 days
  5. 36.6%30 days
  6. 58.9%60 days
This job: posted 4 hours ago

Herotel median: 8 days open

The posting

Are you a security minded leader with a passion for protecting data, managing risk and building trust across a growing business? Join our Information Security & Risk team as Head of Information Security & Risk in Plattekloof, where you’ll own Herotel’s cyber security, IT risk and assurance, and IT and AI governance, and serve as our Information Officer under POPIA and PAIA.

This role is perfect for a decisive, strategic and resilient security professional who thrives on setting the standard, enjoys reporting to executives and boards, and is excited to lead a small, high impact team.

What you’ll do:

  • Own Herotel’s cyber security strategy, programme and control framework across cloud, on premises and network environments
  • Drive the Zero Trust and identity roadmap, including Conditional Access, compliant devices, passwordless and privileged access
  • Oversee security operations and make decisions on security tooling and managed security services (MDR/SOC), in line with the Maziv group
  • Act as the decision point for major security incidents, including executive communication
  • Set security baselines, guardrails and identity standards for AWS, Azure, Microsoft 365 and software development, and track compliance and remediation with the Technology teams
  • Run the security and POPIA review gate for new systems, automations, AI agents and significant changes before go live
  • Own IT disaster recovery and business continuity policy, RTO and RPO targets and the annual DR test programme, and report results to Exco and the Audit Committee
  • Sponsor the ISO 27001 programme and own the information security policy framework, with ISO 27001 certification achieved within the agreed timeline
  • Maintain the IT risk register and report on cyber and IT risk to Exco, the Audit & Risk Committee, the Board and the Maziv group
  • Lead the IT scope of the annual external IT audit (ITGC/ITAC) and quarterly privileged and user access reviews, tracking findings to closure
  • Set and manage the cyber security and compliance budget, vendors and contracts with the CFO
  • Serve as Herotel’s Information Officer under POPIA and PAIA, owning the compliance framework, DPIAs, operator agreements and data subject requests within POPIA timelines
  • Own the AI policy framework and the AI tool and connector approval process, and administer Herotel’s enterprise AI platforms
  • Oversee security awareness, phishing simulation and POPIA training, and deliver the weekly cyber security pack to managers and Exco
  • Act as product owner of Herotel’s in house security platforms (IT Metrics, My IT Status and CodeScan)
  • Lead, develop and manage the performance of the Cybersecurity Engineer and the IT Governance, Risk & Compliance Officer

What you’ll need:

  • A Bachelor’s degree in Computer Science, Information Technology, Information Systems, Information Security or a related field
  • A minimum of 10 years’ IT experience, including at least 5 years in cyber security or IT risk and 5 years in a leadership role
  • Proven experience securing and governing AWS and Azure environments, including Microsoft Entra ID and Zero Trust controls such as Conditional Access, Intune compliance and privileged identity management
  • Experience setting disaster recovery and backup standards and running DR test programmes, including ransomware recovery
  • Experience in IT risk and assurance, including risk registers, external IT audits (ITGC/ITAC), access reviews and reporting to Exco, audit and risk committees and group shareholders
  • Practical experience with POPIA and PAIA (data subject requests, DPIAs and operator agreements) and with ISO 27001
  • Experience managing security budgets, vendor contracts and managed security services (MDR/SOC)
  • Strong knowledge of information security principles, controls and regulatory requirements, and of modern security tooling (SIEM, EDR, cloud security posture management and vulnerability management)
  • A working understanding of the software development lifecycle and of ITIL incident, change and problem management
  • ISP or telecommunications experience is strongly preferred
  • Exposure to NIST CSF, CIS Controls or King IV will be advantageous
  • Data and scripting skills (for example Python and SQL) for security metrics and reporting automation will be advantageous
  • Security certifications such as CISM, CISSP or CRISC, cloud security certifications such as CCSP, AWS Certified Security Specialty or Microsoft Certified: Cybersecurity Architect Expert, ISO 27001 Lead Implementer or Lead Auditor, and privacy or business continuity certifications will be advantageous
  • The ability to set strategic direction and a clear roadmap aligned to company strategy, with strong systems thinking
  • Strong stakeholder management and communication skills at all levels, including leading change
  • Sound, timely decision making under pressure, with strong planning, prioritisation and problem solving skills
  • A high level of confidentiality and integrity

What we offer:

  • Exposure to a dynamic workplace
  • A chance to grow your skills through our internal academy
  • A friendly, team-driven environment
  • Group Risk Benefits
  • Medical Benefits
  • Health and Lifestyle Programmes

Important Disclaimer:

  • Please ensure that the information you provide in your application is true, accurate, and correct.
  • Preference will be given to candidates from Designated Groups, as defined by the Employment Equity Act and in line with Herotel’s Employment Equity Plan.
  • By submitting an application, you consent to the processing of your personal information in accordance with POPIA for recruitment purposes. For more details on how we handle personal information, please refer to our Privacy Policy on our website.
  • If you do not hear from us within 14 days, please consider your application unsuccessful.
From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against Herotel's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on Herotel's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    Herotel's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.