Farrah Khan

Highly accomplished Information Security Officer with extensive experience in developing and implementing multi-layered security systems, risk management, and regulatory compliance. Proven ability to lead successful SOC 1/2, PCI-DSS, SOX, POPIA, and SARB audits, aligning cybersecurity postures with NIST and ISO standards. Expertise in cloud security (AWS, Azure), identity governance, and threat mitigation.

Seeking to leverage a strong track record of enhancing security posture and protecting sensitive data to drive security excellence at [Target Company].

Information Security Officer at Lesaka Technologies Inc. (2024-07 – Present)

• Orchestrated multi-layered security systems within the Enterprise division, integrating SentinelOne, Netskope, DarkTrace, and Drata.
• Engineered a bespoke security tool to provide enterprise-wide visibility into security posture and associated value at risk, delivering customized reporting.
• Partnered with Infrastructure and product teams to embed security seamlessly into new and existing environments.
• Formulated security roadmaps and served as the technical lead for the digital identity project, centralising identity management within the Enterprise division.
• Spearheaded and successfully concluded SOC 1 Type 2 and SOC 2 Type 2 audits for Lesaka Technologies Enterprise division in under one month.
• Attained successful completion of multiple PCI-DSS and SOX ITGC audits, while actively assisting technical and operational teams in timely remediation of audit findings.
• Secured POPIA and SARB Directive 1 regulatory compliance through audit completion and the implementation of aligned security safeguards.
• Facilitated secure cloud environments (AWS and Azure) during the migration of on-premises infrastructure.
• Authored, updated, and maintained the cybersecurity risk register for the Enterprise division.
• Harmonised the Enterprise cybersecurity posture with NIST SP 800-53, ISO 27001, ISO 27002, ISO 27001, and NIST CSF standards.
• Developed golden images to standardise security across the Enterprise environment.
• Documented secure architectural designs for the Identity environment and other critical business systems within Enterprise.

Merchant SecOps Lead at Lesaka Technologies Inc. (2022-01 – 2024-06)

• Designed and deployed comprehensive security dashboards for enhanced reporting capabilities.
• Served as the lead implementer for Rapid7 solutions within the merchant division.
• Elevated endpoint security controls by 53%, data security protection by 64%, and identity protection by 47%, resulting in an overall security posture increase from 29.1% to 72.7%.
• Successfully decommissioned over 44% of end-of-life systems within the Enterprise Division.
• Authored and instituted an incident response library for effective handling of security threats, data breaches, and incidents.
• Established and implemented standard operating procedures for the security technical stack within Enterprise.
• Deployed Teleport to enable secure access to enterprise resources.
• Integrated Immersive Labs within Enterprise to deliver comprehensive security awareness training to all users.

Security Administrator at Lesaka Technologies Inc. (2021-04 – 2023-12)

• Oversaw user access and permissions, ensuring adherence to the principle of least privilege for sensitive resources.
• Installed, configured, and maintained critical security software and hardware, including firewalls, authentication systems, and intrusion detection systems.
• Executed regular security audits to proactively identify and mitigate potential network threats.
• Analyzed system logs to detect suspicious activities and conduct thorough investigations of security breaches.
• Responded promptly to security incidents to minimise damage and operational disruption.
• Liaised with IT teams to ensure the effective implementation of security measures.
• Developed and maintained comprehensive documentation for all security policies and procedures.
• Administered security systems across multiple departments, ensuring strict compliance with company policies and regulatory requirements.
• Established and enforced security protocols to safeguard sensitive information and data.

Information Security Analyst at The Foschini Group (2018-01 – 2021-04)

• Executed a successful antimalware endpoint protection upgrade across 20,000 endpoints.
• Continuously managed the antimalware environment for two years, maintaining a compliance standard of 98% for all audits.
• Successfully deployed Data Loss Prevention (DLP) infrastructure and packaged deployments to the Head Office estate of 4,600 endpoints.
• Established and facilitated a new antimalware environment for the subsidiary brand in the UK.
• Automated various security tasks and workflows, enabling accurate reporting based on endpoint telemetry.
• Implemented infrastructure and facilitated log ingestion for a Next Generation SIEM, focusing on User Entity Behavior Analytics, and successfully decommissioned the prior SIEM.
• Contributed to the successful recertification of PCI DSS compliance for the past two years.

ND in Information Technology – Cape Peninsula University of Technology (2014 – 2017)