The posting
The Cybersecurity & Network Engineer owns Rohloff Group's cybersecurity, identity security, data protection and enterprise network capability. Reporting to the IT Manager, the role designs, operates and continuously improves security and connectivity across restaurants, offices, Microsoft 365, Azure and the wider technology estate. The role is accountable for security-control design, cyber-risk governance, threat detection and response, network architecture and technical controls supporting POPIA, GDPR and organizational security policies.
What You'll Be Cooking
Security Architecture & Engineering
- Design and maintain security architecture across Microsoft 365, Azure, endpoints, identity, email, cloud applications, networks and third-party integrations.
- Own and prioritise the security improvement roadmap, incorporating material risks, incidents, audit findings and Microsoft Security recommendations.
- Engineer and govern controls using Microsoft Defender XDR, Defender for Endpoint, Defender for Office 365, Defender for Cloud Apps, Entra ID and relevant Azure security services.
- Define security standards, technical baselines, architecture patterns, security logging requirements and control validation methods.
- Maintain security architecture, data-flow diagrams, incident runbooks, firewall records, risk decisions and security exception records.
- Embed security and privacy by design into projects, suppliers, cloud adoption, application changes, infrastructure designs and data-processing activities.
Identity & Privileged Access Security
- Own Entra ID security policy, Conditional Access, MFA, authentication methods, passkeys, Windows Hello for Business, Identity Protection and identity-risk controls.
- Own privileged-access policy and control design for PIM, Azure RBAC, emergency access, administrative roles and least-privilege models.
- Govern joiner, mover, leaver, service-account, guest and third-party administrator security requirements.
- Investigate identity compromise, risky sign-ins, token abuse and privilege escalation, and lead security containment and remediation.
- Conduct access and privileged-role reviews with controlled, approved and time-bound exceptions.
- Consult on Active Directory and hybrid identity architecture; the Infrastructure & Services Engineer remains accountable for directory availability, domain services and synchronisation operations.
Network Architecture & Engineering
- Own secure network architecture and operational network services across restaurants, offices, cloud environments and data platforms.
- Design, configure and troubleshoot FortiGate, FortiAnalyzer, FortiAP, SD-WAN, VLANs, routing, IPSec VPN, secure remote access and wireless.
- Own firewall policy, rule reviews, secure publishing, web filtering, intrusion prevention, DNS security, network logging and segmentation.
- Maintain separation between corporate, restaurant, guest, mobile, operational and management networks.
- Resolve complex packet-flow, routing, tunnel, authentication, capacity and application-connectivity incidents.
- Coordinate network changes with the Infrastructure & Services Engineer where servers, Azure services, identity, backup or application dependencies are affected.
Threat Operations & Incident Response
- Lead investigation, classification, containment and eradication for malware, ransomware, phishing, identity compromise, data exposure and intrusion.
- Own the cyber-incident timeline, evidence preservation, root-cause analysis, lessons learned and security corrective-action register.
- Act as technical incident lead while malicious activity or compromise remains suspected or confirmed.
- Hand service restoration, rebuild and recovery execution to the Infrastructure & Services Engineer once recovery criteria are agreed, while retaining authority over security validation before reconnection.
- Improve alerting, detection coverage, threat hunting, attack-surface reduction and escalation workflows.
- Coordinate specialist security, SOC and forensic partners through approved incident processes.
- Plan and run cybersecurity simulations and technical incident-response exercises.
Vulnerability, Governance & Third-Party Risk
- Own vulnerability identification, risk-based prioritisation, remediation targets, tracking and independent verification of closure.
- Assign infrastructure remediation actions to the Infrastructure & Services Engineer and application remediation actions to the relevant system owner.
- Coordinate penetration testing and require accountable owners, due dates, evidence and formal risk acceptance for deferrals.
- Provide security evidence for audits, cyber insurance, governance, franchisor requirements and assessments of technical compliance with POPIA, GDPR and organisational data-protection policies.
- Maintain cyber-risk registers and evidence of access reviews, control exceptions, remediation decisions and formal risk acceptance.
- Assess security and data-protection risks arising from suppliers, remote access, integrations and technology changes.
Endpoint and Cloud Security Boundaries
- Define and approve endpoint-security baselines, Defender policies, attack-surface reduction rules, security exclusions, encryption requirements and security-compliance criteria.
- Own Microsoft Defender security configuration, alert investigation, threat hunting and control validation.
- Consult on Intune implementation. The Infrastructure & Services Engineer remains accountable for Intune platform administration, Autopilot, device enrolment, application deployment, operating-system servicing and policy deployment.
- Own Azure and Microsoft 365 security architecture, security posture, security logging and privileged-access controls. Infrastructure remains accountable for platform availability and operational administration.
Environment and Platforms
- Microsoft Defender XDR, Defender for Endpoint, Defender for Office 365 and Defender for Cloud Apps.
- Microsoft Entra ID, Conditional Access, authentication methods, Identity Protection, PIM and Azure RBAC.
- Microsoft Intune and endpoint security policy dependencies.
- Microsoft Azure and Microsoft 365 security controls, logging and security administration.
- FortiGate, FortiAnalyzer, FortiAP, SD-WAN, VPN, VLAN, routing and wireless.
- SIEM/SOC integration, vulnerability management and incident-response tooling.
- Enterprise LAN, WAN, internet, restaurant connectivity, guest wireless and remote access.
What You'll Bring to the Table:
- 8+ years of enterprise networking and cybersecurity experience, including at least 3 years operating as a senior engineer, technical lead or final escalation resource in a multi-site hybrid-cloud environment.
- Demonstrated accountability for the security, availability and continuous improvement of enterprise security and network services.
- Proven leadership of high-impact cyber or identity investigations and containment.
- Proven design and troubleshooting of Fortinet-based networks, secure remote access and segmentation.
- Relevant diploma, degree or equivalent senior-level industry qualification.
- Microsoft SC-200 and SC-300 expected or equivalent proven capability; SC-100 and AZ-500 strongly preferred. Practical experience with the CrowdStrike Falcon platform in conjunction with Microsoft Defender XDR is beneficial.
- Current Fortinet professional-level certification aligned to deployed technologies strongly preferred.
- CISSP, CISM or equivalent is beneficial, with deep hands-on engineering capability required.
- Expert Fortinet architecture and administration, including routing, VLANs, firewall policy, logging, VPN, wireless, segmentation and packet-flow troubleshooting.
- Advanced Microsoft Defender XDR investigation, detection tuning and Microsoft 365 security administration.
- Deep Entra identity security, Conditional Access, authentication, PIM and privileged-access expertise.
- Strong incident-response capability covering triage, containment, evidence, root cause and corrective action.
- Practical vulnerability management, secure configuration, segmentation and attack-surface reduction.
- Ability to correlate identity, endpoint, email, cloud and network telemetry under pressure.
- Practical PowerShell or equivalent scripting and automation.
Why You'll Love It Here:
- Competitive salary and bonuses.
- Comprehensive benefits.
- Collaborative, inclusive, and flexible work environment.
