Security Engineer

About Kaelo

Kaelo provides essential healthcare solutions ensuring the physical and psychosocial wellbeing of all South Africans towards lasting social change. Kaelo meets the Healthcare needs of Corporate and Retail clients across South Africa – products offerings include Medical Insurance, Medical Aid, Gap Insurance, Kaelo Money and employee assistance programmes.

Company Description

Kaelo provides essential healthcare solutions ensuring the physical and psychosocial wellbeing of all South Africans towards lasting social change. Kaelo meets the Healthcare needs of Corporate and Retail clients across South Africa – products offerings include Medical Insurance, Medical Aid, Gap Insurance, Kaelo Money and employee assistance programmes.

Job Description

The Security Engineer is Kaelo's dedicated cyber security capability. Reporting to the Head of IT, the role combines hands-on engineering of security controls across the technology estate with the governance, risk and compliance work required to evidence those controls to regulators, auditors and customers. A significant part of the role is security assurance in both directions: completing the security questionnaires that customers send to Kaelo, assessing Kaelo itself and its vendors, and working with internal teams or the vendor concerned to close the gaps found. The incumbent also creates and maintains the Information Security Management System (ISMS) supporting Kaelo's pursuit of ISO 27001 certification, under the direction of the IT Executive, and supports alignment to FSCA Joint Standard 2, POPIA, the Cybercrimes Act, the CIS Controls and the NIST Cybersecurity Framework.

Key Responsibilities

• Security Engineering & Control Implementation
• Implement, configure and maintain technical security controls across endpoints, servers, cloud, network and identity.
• Operate endpoint detection and response, email security, web filtering and data loss prevention tooling.
• Harden systems against CIS Benchmarks and maintain secure baseline configurations across the estate.
• Work with the Cloud Engineer to apply security controls in the Cloud and co-location environments.
• Identity & Access Management
• Maintain multi-factor authentication, conditional access and privileged access controls, enforcing least privilege.
• Run periodic user access reviews and retain the evidence these produce.
• Ensure joiner, mover and leaver processes are enforced and evidenced.
• Vulnerability Management, Monitoring & Incident Response
• Run vulnerability scanning, triage and remediation tracking, and coordinate penetration tests and the closure of their findings.
• Monitor security alerts and logs, triage events and elevate in line with the incident response plan.
• Support the response to security incidents, including containment, recovery and post-incident review, under the direction of the IT Executive and as executed by the Head of IT.
• Support statutory notification obligations, including POPIA breach notification and reporting under the Cybercrimes Act.
• Security Questionnaires & Third-Party Assurance
• Complete security questionnaires received from customers and prospective customers, providing accurate responses and supporting evidence on Kaelo's behalf.
• Maintain a library of approved standard responses, policies and evidence so that questionnaires are answered consistently and quickly.
• Issue security questionnaires to Kaelo's vendors and service providers, assess the responses and rate the risk.
• Self-assess Kaelo against its own policies and the frameworks it aligns to, identifying control gaps.
• Work with internal teams or the relevant vendor to agree remediation of gaps and track it through to closure.
• ISMS, Governance & Compliance
• Maintain the ISMS under the direction of the IT executive, including the risk register, risk treatment plan and Statement of Applicability.
• Implement and evidence Annex A controls, and maintain the evidence required for internal audit and ISO 27001 certification audits.
• Support control mapping and gap assessment against FSCA Joint Standard 2, the CIS Controls and the NIST Cybersecurity Framework.
• Maintain the information security policy set and support POPIA compliance in partnership with the Information Officer.
• Awareness, Resilience & Reporting
• Run the security awareness programme, including phishing simulation.
• Contribute to business continuity and disaster recovery planning from a cyber resilience perspective.
• Report on security posture, questionnaire activity, vendor risk and gap remediation to the Head of IT and IT executive.
• Alignment, Reporting & Escalation
• Align work to, and execute, the direction and strategy set by the IT Executive