Data Governance and Privacy Manager

Old Mutual Insure Limited; Johannesburg; Presencial; ZAR 900 000 - 1 500 000; Tempo integral

Resumo da oferta

Old Mutual Insure Limited is seeking a Data Governance and Privacy Manager to lead 2nd line oversight of data governance, data risk, data quality and privacy compliance across OMI. The role ensures data is treated as a strategic asset and aligned with POPIA.

The incumbent provides independent challenge to 1st line teams while embedding data governance across governance, risk management and regulatory compliance processes.

Qualificações

• Bachelor’s degree in information systems, data management, computer science, risk management, information security, statistics, business or related discipline.
• A relevant postgraduate qualification in Risk Management, Information Systems, Data Governance or related field would be advantageous.

Responsabilidades

• Establish and maintain the Data Risk Management Framework aligned to enterprise risk framework.
• Provide independent oversight of data governance policies, standards, procedures and control frameworks.
• Oversee Data Protection Impact Assessments (DPIAs) for new initiatives and technology implementations.
• Assess data controls for accuracy, completeness, timeliness, uniqueness and fitness for purpose.
• Provide independent oversight of data classification, access restrictions, encryption, anonymisation, secure transfer and retention.

Conhecimentos

Data governance

Data risk management

Privacy compliance

POPIA awareness

Formação académica

Bachelor’s degree in information systems, data management, computer science, risk management, information security, statistics, business or related

Descrição da oferta de emprego

Let's Write Africa's Story Together! Old Mutual is a firm believer in the African opportunity and our diverse talent reflects this.

Job Description The Data Governance and Privacy Manager

The Data Governance and Privacy Manager is responsible for establishing, leading, and maintaining independent 2nd line oversight of data governance, data risk, data quality and privacy compliance across OMI. This role ensures that OMI manages data as a strategic and regulatory compliant asset. The incumbent provides independent challenge to 1st line operational teams (IT, Data Architecture, Engineering, Underwriting, Claims and Operations) while ensuring full alignment with SA regulatory mandates and requirements (e.g. POPIA).

Responsibilities will include the following:

Data Risk Framework and AppetiteDevelop, maintain and embed the Data Risk Management Framework, policy and standards, aligned to the Old Mutual Group enterprise risk framework.Define the data risk taxonomy (data quality, data privacy, data lineage, retention, data access, AI/model data, third-party data).Propose data risk appetite statements, key risk indicators (KRIs) and tolerance thresholds for approval by the risk committees.Provide independent oversight of the implementation and effectiveness of data governance policies, standards, procedures and control frameworks.Ensure that data risks are appropriately integrated into enterprise risk registers, technology risk assessments, operational risk assessments and relevant business risk management processes.Maintain a forward-looking view of emerging data risks arising from business strategy, digital transformation, acquisitions, technology changes, outsourcing and new data use cases.

Independent Data Risk Oversight and Challenge

Conduct independent reviews and risk assessments of material data processes, systems, business initiatives, third-party vendor data sharing agreements and change programmes.Review and challenge first-line risk and control self-assessments (RCSAs) for data-related risks across underwriting, claims, finance, actuarial and IT.Oversee and challenge Data Protection Impact Assessments (DPIAs) for all new business initiatives products, and technology implementations.Evaluate the design and operating effectiveness of data controls, including preventive, detective and corrective controls.Identify systemic weaknesses, recurring control failures and risk concentrations across business units, applications, data domains and third parties.Review material data incidents, breaches, quality failures and reporting inaccuracies to assess root causes, control weaknesses and the adequacy of management responses.Track data risk events, incidents and breaches through root-cause analysis to closure of remediation actions.

Data Governance and Data Quality Oversight

Assess whether appropriate controls exist to ensure data is accurate, complete, consistent, valid, timely, unique and fit for its intended purpose.Oversee the risk management practices supporting data lineage, traceability, reconciliation and data transformation across source systems, operational platforms, data warehouses and reporting environments.Monitor material data quality issues, recurring exceptions, unresolved defects and the effectiveness of corrective actions.Provide oversight of data migration and conversion risks, including reconciliation, completeness validation, record integrity and business sign-off.Assess the reliability of critical management information and regulatory submissions where data deficiencies could affect decision-making, financial soundness or regulatory compliance.

Data Privacy, Protection and Confidentiality Risk

Provide independent oversight of data protection and privacy risks in collaboration with the Information Officer, Privacy, Legal, Compliance and Information Security functions.Assess whether appropriate controls are in place to protect personal, sensitive, confidential and commercially critical information throughout its lifecycle.Oversee risk management arrangements relating to data classification, access restrictions, encryption, masking, anonymisation, secure transfer, retention and secure disposal.Assess risks associated with unauthorised access, disclosure, loss, alteration, misuse or inappropriate sharing of data.Challenge weaknesses in data access governance, including excessive privileges, inappropriate access, segregation‑of‑duties conflicts and inadequate periodic access reviews.Assess risks arising from the processing and sharing of policyholder, claimant, beneficiary, employee and other personal information.Provide risk oversight of cross‑border data transfers, outsourced processing, data sharing arrangements and the use of external service providers.Monitor material data privacy and confidentiality incidents, ensuring that root causes, control weaknesses and corrective actions are addressed by accountable First Line owners.Support the relevant control functions in assessing compliance with applicable data protection and privacy obligations, including POPIA.

Critical Data Assets and Data Lifecyle Risk

Establish risk-based criteria for identifying and prioritising critical data assets, datasets, data flows and business processes.Evaluate whether critical data assets are adequately protected against loss, corruption, unauthorised modification and unavailability.Assess data resilience arrangements, including backup integrity, recoverability, restoration testing and dependency on critical data platforms.Assess the risks arising from legacy systems, fragmented data environments, shadow data stores, uncontrolled data extracts and unmanaged copies of sensitive information.

Third- Party, Outsourcing and Cloud Data

Provide oversight of data risks associated with outsourced services, cloud platforms, administrators, service providers, business partners and other external parties.Assess whether third‑party arrangements provide appropriate protection for confidentiality, integrity, availability and lawful processing of organisational data.Challenge the adequacy of data‑related due diligence, contractual safeguards, audit rights, subcontracting arrangements, incident notification obligations and exit provisions.Assess risks associated with external data hosting, offshore processing, concentration of critical data services and dependency on key providers.Monitor material third‑party data risks and remediation commitments in collaboration with Third‑Party Risk Management and Procurement.Provide independent challenge on the adequacy of controls governing the return, transfer, retention and secure destruction of data when contracts terminate or services change.

Issues Management and Remediation Oversight

Maintain oversight of data‑related risk findings, incidents, control deficiencies and agreed management actions.Challenge remediation plans for completeness, practicality, accountable ownership, milestones and sustainable resolution.Validate the adequacy of evidence provided by First Line management to demonstrate that agreed actions have been completed.Monitor overdue actions, repeated findings, management risk acceptance and residual exposure.Escalate ineffective remediation, recurring failures and unresolved material risks to the appropriate governance forums.Collaborate with Internal Audit, Compliance and other assurance providers to support coordinated assurance and reduce duplication of effort.

Qualifications required:

Bachelor’s degree in information systems, Data Management, Computer Science, Risk Management, Information Security, Statistics, Business or a related discipline.A relevant postgraduate qualification in Risk Management, Information Systems, Data Governance or a related field would be advantageous.

Professional Certifications:

Risk and governance: CISA, CRISC, CGEIT, COBIT 2019 would be advantageous.Data Management: Certified Data Management Professional (CDMP), CIPP/E or CIPMExperience, skills and knowledge required: At least 6–8 years of relevant experience in data risk, IT risk, information governance, data governance, information security, technology risk or a related discipline.Strong understanding of data management principles, data quality, metadata, lineage, ownership and lifecycle controls.Experience assessing privacy, information security, data access, data integrity and data availability risks.Exposure to AI governance, model risk or automated decision‑making risk would be advantageous.

Execution Collaboration (Relating) Innovation (Perspective) Leading with Influence Personal Mastery (Learning) Strategic

Skills Action Planning, Adaptive Thinking, Business Requirements Analysis, Business Risk Management, Cultural Awareness, Database Administration, Data Compilation, Data Controls, Data Governance, Data Management, Evaluating Information, Executing Plans, Expertise Management System, Graphical User Interface (GUI) Development, Information Governance, IT Architecture, Privacy Compliance, Readiness Assessments, Risk Framework, Risk Management Strategies, User Requirements Documentation Competencies Action Oriented Business Insight Collaborates Communicates Effectively Courage Cultivates Innovation Customer Focus Decision Quality Education Bachelor of Commerce (BCom): Management,Information Systems & Technology (Required), NQF Level 9 – Masters

The Recruitment Process:

TA Interview: This will be a discussion with our Senior Talent Acquisition Specialist to give you an understanding of our business, our culture & values and more context on the role. It will also allow us the opportunity to get to know you more and ensure OMI can meet your career aspirations.Panel Interview: This will be with 2 members of the Senior Leadership of the Hiring Team and 1 member of the HC Senior Team.Technical & Psychometric Assessments: These will depend on the role and will sometimes happen concurrently with Vetting through an external service provider, as well as Internal Verification.Final Feedback.

All About OMI:

https://www.oldmutual.co.za/about/old-mutual-insure/ Please note that, unfortunately, we cannot accept any applications after the closing date

Closing Date 11 November 2026 , 23:59

The appointment will be made from the designated group in line with the Employment Equity Plan of Old Mutual South Africa and the specific business unit in question.

The Old Mutual Story!

Old Mutual is a premium African financial services organisation that offers a broad spectrum of financial solutions to retail and corporate customers across key market segments in 14 countries. The lines of business include Life and Savings, Property and Casualty, Asset Management and Banking and Lending. We are rooted in our purpose of Championing Mutually Positive Futures Every Day and believe that a great customer experience is anchored in a great employee experience.