ROLE PURPOSE
The IT & OT Supplier Governance Specialist is accountable for the commercial, contractual, and operational integrity of Service Provider suppliers and subcontractors delivering into IT and OT environments under the SDM's client portfolio. This role exists because supplier-delivered service is still Nexio's accountability - a failure, breach, or governance gap at a subcontractor is a failure at Nexio, not a pass-through risk.
The role owns supplier performance against contracted terms, not supplier relationship management for its own sake. It converges IT and OT supplier governance into a single accountability point, closing the gap where OT vendors (network, infrastructure, industrial/operational systems) are often governed less rigorously than IT vendors - despite carrying equal or greater client, safety, and compliance exposure.
What This Role Owns (Outcome Commitments):
-
Supplier Performance & Compliance — Service Provider and subcontractor delivery measured against SLA, contractual, and regulatory obligations across both IT and OT environments - not assumed, verified.
-
Risk Containment Identification of supplier-originated risk (security, compliance, delivery, financial stability) before it surfaces as a client-facing incident or escalation.
-
Contractual & Commercial Integrity - Supplier contracts, SLAs, and pricing terms actively governed and reconciled against what was sold to the client.
-
OT-Specific Governance - Application of appropriate governance rigour to operational technology suppliers (industrial systems, network infrastructure, critical operational environments), where consequences of failure differ materially from standard IT service failure.
-
Audit & Evidence Trail - Maintenance of governance documentation sufficient to withstand client, regulatory, and internal audit scrutiny - evidence of control, not evidence of activity.
What Success Looks Like:
Every supplier within scope is governed against a current, reconciled contract; no supplier-originated risk reaches the client as a surprise; and audit or client scrutiny of the supply chain finds a defensible, documented governance trail rather than informal relationship management.
ROLE ACCOUNTABILITIES / KEY ACTIVITIES
1. Supplier Contract & Commercial Governance
Accountable for: Ensuring every in-scope supplier is governed against a current, reconciled contract including Nexio services - not legacy terms or informal arrangements.
-
Maintain a live supplier register per client environment, mapping each supplier to the contract clauses, SLAs, and commercial terms they are bound by
-
Reconcile supplier pricing and terms against what was commercially sold to the client - flag margin exposure introduced by supplier cost creep or scope drift
-
Validate that subcontracted OT suppliers carry terms appropriate to operational/critical environments, not generic IT boilerplate
2. Supplier Performance & SLA Compliance
Accountable for: Verified - not assumed supplier delivery against contracted commitments across IT and OT scope.
-
Track supplier performance against SLA/SLO commitments, distinguishing IT service metrics (availability, MTTR) from OT-specific metrics (uptime of industrial/network systems, safety-critical response times)
-
Conduct scheduled and ad hoc supplier performance reviews; document underperformance formally, not informally, with a clear remediation trail
-
Escalate persistent supplier non-performance through formal contractual mechanisms (penalty clauses, escalation triggers) rather than absorbing the gap operationally
-
Feed supplier performance data into the SDM's client-facing service health reporting - supplier risk must be visible at the account level, not siloed
3. Risk & Compliance Management at the Supply Chain Boundary
Accountable for: Identifying and containing supplier-originated risk before it becomes a client-facing incident.
-
Maintain a supplier risk register, classified explicitly as confirmed risk, assumption, or contained/mitigated - consistent with departmental risk discipline
-
Assess supplier security posture and compliance status (data handling, POPIA where applicable, industry-specific regulatory requirements for OT/critical infrastructure)
-
Apply differentiated risk treatment to OT suppliers where failure consequences extend beyond service disruption (e.g. safety, regulatory, critical infrastructure exposure)
-
Coordinate supplier-side root cause analysis when a supplier failure contributes to a Major Incident, ensuring findings feed back into contract and governance terms
4. Governance Framework & Standardisation
Accountable for: A consistent governance approach across a supplier base that spans IT and OT, avoiding fragmented or ad hoc oversight.
-
Apply ITIL 4 Supplier Management practice consistently across all in-scope suppliers, adapted for OT-specific operating realities where standard IT process doesn't translate
-
Standardise supplier onboarding, offboarding, and periodic re-assessment processes — controlled consistency, not one-off arrangements per supplier
-
Maintain governance documentation to a standard that withstands client, regulatory, and internal audit without remediation
-
Identify where supplier governance gaps exist structurally (e.g. OT suppliers historically under-governed relative to IT) and drive closure of those gaps
5. Stakeholder Coordination & Escalation
Accountable for: Ensuring supplier-related risk and performance issues are visible to the right stakeholders before they surface as surprises.
-
Provide the SDM with supplier governance input for client service reviews - health, risk, and compliance status, not raw supplier activity logs
-
Coordinate with Commercial/Sales where supplier terms intersect with client-facing commercial commitments, ensuring no conflict between what was sold and what suppliers are contracted to deliver
-
Escalate supplier financial stability or delivery-capability concerns early - before they manifest as a client-facing service failure
-
Support incident and major incident processes where supplier involvement requires coordinated response across Nexio and Service Provider teams
COMPETENCIES (KNOWLEDGE, SKILLS AND ATTRIBUTES)
Technical & Domain Competencies
-
Supplier / Vendor Management Discipline - Structured application of formal supplier governance methodology (contract management, performance measurement, risk assessment) - not relationship management by default
-
ITIL 4 Supplier Management Practice - Working fluency in supplier management as a formal ITIL practice, integrated with Incident, Problem, and Change processes
-
OT/IT Convergence Understanding - Ability to distinguish and correctly apply governance rigour across IT service suppliers and OT/industrial/critical infrastructure suppliers, recognising that failure consequences differ materially between the two
-
Contract & Commercial Literacy - Ability to read, interpret, and reconcile supplier contracts against client-facing commercial terms; identify margin exposure and scope drift introduced upstream
-
Risk & Compliance Acumen - Working knowledge of regulatory and compliance considerations relevant to critical infrastructure, industrial systems, and data handling (POPIA and sector-specific requirements where applicable)
-
Governance & Audit Readiness - Ability to build and maintain documentation and evidence trails that withstand client, regulatory, and internal audit scrutiny without remediation
Analytical & Judgement Competencies
-
Separation of Fact, Assumption, and Risk - Consistently distinguishes verified supplier performance from assumed or self-reported performance; never presents supplier "evidence of activity" as "evidence of control"
-
Structural Risk Identification - Identifies systemic governance gaps (e.g. OT suppliers historically under-governed relative to IT) rather than only responding to individual supplier incidents
-
Commercial Judgement - Understands the financial implications of supplier decisions on contract margin, not just operational continuity
-
Defensible Decision-Making - Able to justify supplier escalation, remediation, or termination decisions with a clear evidentiary trail, anticipating scrutiny from Legal, Commercial, and the client
Relationship & Influence Competencies
-
Firm but Constructive Supplier Engagement - Holds suppliers to contracted standard without relationship management overriding governance discipline; escalates formally rather than absorbing underperformance informally
-
Cross-Functional Coordination - Works effectively across Commercial, Legal, SDM, and client-facing teams, ensuring supplier governance findings are visible where they need to be, not siloed
-
Stakeholder Communication Under Pressure - Communicates supplier-originated risk clearly and early, particularly in incident or major incident scenarios involving third parties
-
Influence Without Direct Authority - Drives supplier accountability and internal process adherence despite not holding a direct management relationship with supplier personnel or, in some cases, with internal teams relying on the supplier
Behavioural Competencies
-
Structured, Governed Communication - Written and verbal communication reflects a defensible position, not a status update; no hedging language, no ambiguity on risk
-
Attention to Contractual Detail - Precision in reading and applying contract terms; does not generalise or approximate obligations
-
Resilience Under Multi-Supplier Complexity - Manages governance across multiple concurrent suppliers, contracts, and environments (IT and OT) without losing clarity of individual risk positions
QUALIFICATIONS & EXPERIENCE
Minimum Qualifications
-
Bachelor’s degree in information technology, Supply Chain Management, Business Management, or a related field (essential)
-
ITIL 4 Foundation certification (essential); ITIL 4 Specialist: Create, Deliver and Support, or exposure to the Supplier Management practice specifically - strongly preferred
-
Formal training or certification in Contract Management, Procurement, or Vendor/Supplier Management - advantageous, not mandatory
-
ISO awareness, particularly Supplier Management clauses - advantageous
Minimum Experience
-
5–7 years in Supplier/Vendor Management, Procurement, Contract Management, Risk Management within an IT/Telecommunications or Managed Services environment (non-negotiable - generic procurement experience without technical/service delivery context will not translate to this role's demands)
-
Demonstrated experience governing suppliers against SLA and contractual performance - not just relationship or sourcing management
-
Direct experience managing supplier-related risk, including security, compliance, and delivery-capability assessment
-
Experience working across both IT and OT supplier environments preferred; where absent, demonstrated ability to apply differentiated governance rigour across environments with materially different risk profiles will be assessed
-
Experience supporting or leading root cause analysis where service providers/subcontractor failure contributed to a service incident
-
Experience operating within, or governing suppliers into, environments with formal audit and regulatory compliance requirements (e.g. critical infrastructure, financial services, utilities, telecommunications)
