Werner Verwey

Information Security Specialist with 15+ years' experience spanning network engineering, operational security, governance and compliance across financial services, telecommunications, manufacturing, FMCG and retail industries.

Information Security Specialist at TILT ADVISORY (2019-01 – Present)

Current secondment (2021–current) within a Security, Risk and Governance team in the FMCG sector, my duties include:

• Led rapid end-user security tool adoption during an active incident, deploying containment and eradication capabilities to neutralise a hands-on threat actor within 48 hours
• Streamlined security tool portfolio by decommissioning underutilised solutions and aligning roadmap to strategic objectives; replaced McAfee with Microsoft Defender XDR, realising ZAR 1.4 million annual savings
• Defined and managed full lifecycle of infrastructure-outsourcing RFP for operational security requirements: authored control specifications, scored and interviewed nine vendors, and influenced final selection based on risk, cost and service fit
• Partnered with HR on Identity & Access Governance to reconcile user, contractor and service-account inventories; executed dormancy/orphan cleanup, privileged access review campaigns, and automated onboarding & birthright provisioning for 4 000+ corporate identities
• Run and maintain vulnerability management program: vulnerability scanning, prioritisation, SLA reporting and remediation tracking
• Develop and maintain Cyber Operations reporting: Power BI dashboards, monthly operational and executive summaries; chair operational-security steering committee

Information Security Specialist at TILT ADVISORY (2019-01 – 2021-12)

Two-year secondment (2019–2021) within IT Governance Department at a multinational retail organisation:

• Drove POPIA compliance initiative in collaboration with Legal and Compliance teams: translated privacy requirements into updated policies, conducted impact assessments across business units, and rolled out targeted awareness training to 1 200 employees
• Oversight and tracking of information security program: align policies and standards with business changes; provide security guidance for strategic initiatives
• Led cyber preparations for COVID-19 lockdown: implemented remote access security controls, trained users on secure remote ways of working

Senior Associate at PWC CYBER AND PRIVACY AFRICA (2016-01 – 2019-12)

Internal Managed Security Services team, I performed the following:

• Built and launched a "Vulnerability Management as a Service" solution: led end-to-end tool selection, negotiated vendor contracts, and defined the technical architecture
• Commercialised the service: packaged the offering, pitched to prospects, and closed sales with five large enterprise customers
• Coordinated ongoing delivery: maintained the threat landscape monitoring function, ran remediation planning workshops, and performed cyber threat assessments
• Drove continuous service improvement: refined service definitions, optimised tool integrations, and incorporated client feedback into roadmap updates

Principal advisor for PCI DSS and DESV at PWC CYBER AND PRIVACY AFRICA (2016-01 – 2019-12)

Principal advisor for PCI DSS and DESV at a major African retailer:

• Developed, tracked and advised on PCI DSS 3.1 compliance project; achieved and maintained Level 1 compliance through annual QSA assessments

Information Security Specialist at PWC CYBER AND PRIVACY AFRICA (2016-01 – 2019-12)

Internal IT audit engagements at various sectors, including government, financial services, and manufacturing, which included:

• Assessed control adequacy for vulnerability and patch management
• Audited configuration compliance for firewalls, routers, servers and workstations
• Performed security program maturity assessments

SME for Skybox Security at PWC CYBER AND PRIVACY AFRICA (2016-01 – 2019-12)

Seconded as SME for Skybox Security as part of the pre-sales and professional services team:

• Led deployment, skills transfer and partner training on Skybox platform

Information Security Specialist at SLVA (2014-01 – 2016-12)

Secondment as Information Security Specialist for retail and financial services clients:

• Managed operational security technologies: AV, SIEM, firewalls, IPS/IDS deployment and maintenance
• Conducted PCI DSS gap assessments and remediation planning
• Provided network security advisory services and access governance assessments
• Compiled monthly security posture dashboards
• Represented Skybox Security in South Africa as pre-sales engineer for professional services

Core Networks Engineer at AMOBIA COMMUNICATIONS (2012-01 – 2014-12)

• Oversaw and executed core network projects for wireless ISP
• Provided Level 3 support for operational network issues
• Performed maintenance on network and systems infrastructure

National Diploma in IT Communication Networks – NELSON MANDELA METROPOLITAN UNIVERSITY (2011-01 – 2011-12)