Security Engineer (Cyber Security & GRC)

About Kaelo Kaelo provides essential healthcare solutions ensuring the physical and psychosocial wellbeing of all South Africans towards lasting social change. Kaelo meets the Healthcare needs of Corporate and Retail clients across South Africa – products offerings include Medical Insurance, Medical Aid, Gap Insurance, Kaelo Money and employee assistance programmes.

REQ-04 Role Purpose The Security Engineer is Kaelo’s dedicated cyber security capability. Reporting to the Head of IT, the role combines hands-on engineering of security controls across the technology estate with the governance, risk and compliance work required to evidence those controls to regulators, auditors and customers.

A significant part of the role is security assurance in both directions: completing the security questionnaires that customers send to Kaelo, assessing Kaelo itself and its vendors, and working with internal teams or the vendor concerned to close the gaps found. The incumbent also creates and maintains the Information Security Management System (ISMS) supporting Kaelo’s pursuit of ISO 27001 certification, under the direction of the IT Executive, and supports alignment to FSCA Joint Standard 2, POPIA, the Cybercrimes Act, the CIS Controls and the NIST Cybersecurity Framework.

Key Responsibilities

1. Security Engineering & Control Implementation Implement, configure and maintain technical security controls across endpoints, servers, cloud, network and identity. Operate endpoint detection and response, email security, web filtering and data loss prevention tooling. Harden systems against CIS Benchmarks and maintain secure baseline configurations across the estate. Work with the Cloud Engineer to apply security controls in the Cloud and co-location environments.
2. Identity & Access Management Maintain multi-factor authentication, conditional access and privileged access controls, enforcing least privilege. Run periodic user access reviews and retain the evidence these produce. Ensure joiner, mover and leaver processes are enforced and evidenced.
3. Vulnerability Management, Monitoring & Incident Response Run vulnerability scanning, triage and remediation tracking, and co-ordinate penetration tests and the closure of their findings. Monitor security alerts and logs, triage events and escalate in line with the incident response plan. Support the response to security incidents, including containment, recovery and post-incident review, under the direction of the IT Executive and as executed by the Head of IT. Support statutory notification obligations, including POPIA breach notification and reporting under the Cybercrimes Act.
4. Security Questionnaires & Third-Party Assurance Complete security questionnaires received from customers and prospective customers, providing accurate responses and supporting evidence on Kaelo’s behalf. Maintain a library of approved standard responses, policies and evidence so that questionnaires are answered consistently and quickly. Issue security questionnaires to Kaelo’s vendors and service providers, assess the responses and rate the risk. Self-assess Kaelo against its own policies and the frameworks it aligns to, identifying control gaps. Work with internal teams or the relevant vendor to agree remediation of gaps and track it through to closure.
5. ISMS, Governance & Compliance Maintain the ISMS under the direction of the IT executive, including the risk register, risk treatment plan and Statement of Applicability. Implement and evidence Annex A controls, and maintain the evidence required for internal audit and ISO 27001 certification audits. Support control mapping and gap assessment against FSCA Joint Standard 2, the CIS Controls and the NIST Cybersecurity Framework. Maintain the information security policy set and support POPIA compliance in partnership with the Information Officer.
6. Awareness, Resilience & Reporting Run the security awareness programme, including phishing simulation. Contribute to business continuity and disaster recovery planning from a cyber resilience perspective. Report on security posture, questionnaire activity, vendor risk and gap remediation to the Head of IT and IT executive.
7. Alignment, Reporting & Escalation Align work to, and execute, the direction and strategy set by the IT Executive. Communicate progress and escalate issues and risks to the IT Executive, through the Head of IT where appropriate, promptly and transparently. REQ-04 Qualifications Bachelor’s degree or national diploma in Computer Science, Information Systems, Information Security or a related field. Recognised security certification such as CompTIA Security+, CySA+ or Microsoft SC-200/SC-300; CISSP, CISM or ISO 27001 Lead Implementer advantageous. Experience Essential Minimum 5 years’ experience in information or cyber security, with hands-on technical depth. Experience implementing and operating technical security controls across endpoint, network, cloud and identity. Experience completing or assessing third-party security questionnaires and tracking remediation of the gaps found. Practical exposure to ISO 27001, the CIS Controls or the NIST Cybersecurity Framework. Experience with vulnerability management and security monitoring. Working knowledge of POPIA and its application to security controls. Preferred Exposure to an ISO 27001 certification or surveillance audit. Experience in financial services, insurance or healthcare, and familiarity with FSCA Joint Standard
8. Experience with Microsoft security tooling (Defender, Sentinel, Entra ID). Scripting ability for security automation and evidence collection. Technical Competencies Security Control Implementation across Endpoint, Network, Cloud & Identity Security Questionnaire Completion & Evidence Management Vendor Security Assessment & Third-Party Risk Control Gap Assessment & Remediation Tracking ISO/IEC 27001 ISMS Operation & Annex A Controls FSCA Joint Standard 2, CIS Controls & NIST CSF POPIA & Cybercrimes Act Application Identity, Access & Privileged Access Management Vulnerability Management Security Monitoring & Incident Response Security Awareness Programme Delivery Core Competencies Judgement — distinguishes real risk from theoretical risk and prioritises accordingly. Integrity — represents Kaelo’s security position accurately to customers, auditors and management. Clear Communication — writes precise questionnaire responses and explains gaps plainly to vendors and internal teams. Influence — secures cooperation for remediation without formal authority over those implementing it. Ownership & Accountability — drives findings to closure rather than to a register. Key Performance Indicators (KPIs) Turnaround time and accuracy of customer security questionnaire responses. Proportion of in-scope vendors assessed, and vendor gaps remediated within agreed timeframes. Closure of gaps identified in Kaelo’s self-assessments. Currency of the ISMS risk register, risk treatment plan and Statement of Applicability. Vulnerability remediation within agreed service levels by severity. Closure rate of penetration test and audit findings. Awareness programme completion and phishing simulation results. Regulatory, Risk & Information Security Responsibilities Comply with POPIA in the handling of personal and special personal information, including member health information, and with the Cybercrimes Act, reporting any suspected unlawful access or compromise without delay. Adhere to Kaelo information security policies and the frameworks the organisation aligns to, including FSCA Joint Standard 2 of 2024, ISO/IEC 27001, the CIS Controls and the NIST Cybersecurity Framework. Maintain the evidence required to support the ISMS and internal, external and certification audits within the area of responsibility. Escalate security incidents, control weaknesses and operational risks promptly, and complete all mandatory compliance and awareness training. Personal Attributes Accountability Action orientated Collaborative Communication Business writing skills Manage complexity Problem solving skills Decision thinking Encourages engagement Resilient and adaptive Resourceful Demonstrates self-awareness Purpose driven Significance and values orientated