Information Security Officer

Old Mutual Life Assurance Company (SA) Ltd; Cape Town; On-site; ZAR 900,000 - 1,500,000; Full time

Job summary

Old Mutual Life Assurance Company (SA) Ltd is seeking an experienced Information Security Officer to drive the organisation’s cybersecurity strategy across business units. You will translate policy, risk, and regulatory requirements into practical initiatives and controls to strengthen cyber resilience across applications, infrastructure, and data.

You will lead security roadmaps, promote secure-by-design, and collaborate with IT, risk, and leadership teams to ensure measurable delivery and

Qualifications

• 6-8 years’ experience in information security, cybersecurity, or IT and cyber risk across complex environments.
• Strong knowledge of NIST CSF, ISO/IEC 27001 and COBIT; translate strategy into prioritised roadmaps and executive reporting.
• Relevant certifications such as CISSP, CISM, CRISC or CISA preferred; cloud certifications are an advantage.
• Working understanding of cloud services and best practices; Agile training knowledge is beneficial.
• Excellent written and oral communication and networking skills; proactive and capable of leading teams and stakeholders.

Responsibilities

• Drive delivery of the organisation’s cybersecurity strategy across assigned business units.
• Embed secure-by-design practices and strengthen cyber resilience across applications, infrastructure, data, and third parties.
• Lead security improvement roadmaps, track resilience outcomes and report risk trends to senior leadership.
• Educate employees on information security practices and ensure regulatory alignment and risk management.
• Collaborate with IT, risk, and business units to enable security while supporting business objectives.

Skills

Analytical thinking

Communication skills

Leadership

Negotiation

Problem-solving

Education

Degree / Honours in Information Security / Cybersecurity / IT

Masters (NQF Level 9)

Tools

AWS Cloud Practitioner

AWS Certified Security - Specialty

Job description

Let's Write Africa's Story Together! Old Mutual is a firm believer in the African opportunity and our diverse talent reflects this.

Job Description

We are looking for an experienced Information Security Officer to drive the delivery of the organisation’s cybersecurity strategy across assigned business units. The successful candidate will translate strategic priorities, security policies, regulatory obligations and risk requirements into practical initiatives and sustainable controls that strengthen cyber resilience across applications, infrastructure, cloud, data, third parties and digital services. The role will lead and coordinate the execution of security improvement roadmaps, ensuring that strategic commitments are converted into measurable delivery outcomes. Key priorities include embedding secure-by-design practices, improving control effectiveness, reducing material security exposures, supporting incident preparedness and recovery, and strengthening the ability of critical business services to anticipate, withstand, respond to and recover from cyber disruption. Working closely with business leaders, technology teams, architects, risk functions and the group information security office, the Information Security Officer will remove delivery barriers, influence investment and risk decisions, track resilience outcomes and drive continual improvement in security maturity.

Group Technology & Transformation | IT Governance Risk & Compliance Governance

Develop and maintain Information Security and IT Risk Policies, supporting controls catalogue and related standards across the group to manage / mitigate associated risks. Manage the capability maturity assessments of various IS and IT capabilities per the frameworks adopted (NIST, COBIT, ITIL) bi-annually drive ownership of the improvement plan to achieve agreed targets and to manage associated risks. Analyse outcomes and information to create meaningful insights, to influence focus and budget decisions where input is required. Provide feedback to senior leadership teams (Steering committees, IT leadership forums). Develops and embeds reporting structures per the Information Security and IT management requirements, aligning with Old Mutual Risk and Compliance Governance structures, for risk aggregation and concentration of Old Mutual’s risk exposures. Manage and review various requests and submissions of information to group-wide cyber insurers to determine the best premium for the organisation. Educate and inform employees about our practices and standards.

Regulatory

Ensure that the relevant legislative and regulatory requirements are implemented and enforced in the organisation based on risk appetite, risk tolerance, and capability maturity levels (e.g., Cybercrimes Act, draft joint standard: Cybersecurity and Cyber Resilience, draft joint standard: IT Risk Management). Manage and review various requests and submissions of information to the regulator / provide commentary on draft standards issued by the regulator prior to government approval.

Compliance

Ensure compliance with Old Mutual’s Information Security and IT requirements set out in policies, the controls catalogue, related standards, regulatory requirements, and industry guidelines. Achieve agreed policy compliance targets for the Information Security and IT risk policies.

Leadership

Collaborate / partner with various stakeholders at different levels across the organization (IT, Audit, Business Units, Project teams, etc.) to obtain buy-in, ensure alignment, and achieve deliverables. Lead a team of professionals and third-party service providers to achieve the agreed objectives per Old Mutual’s values, timelines, and budget. Recommended or support optimisation/efficiency / enhancement opportunities aligned to the IT strategy, e.g., automation.

Business Unit Security Strategy Embedment and Oversight Champion

Act as the primary security interface between assigned business units and the CISO office, providing trusted advice, challenge, and coordination on security priorities, risks, and decisions. Participate in design reviews and identify potential mitigation strategies for security risks. Analyse business impact and exposure based on emerging security threats. Support the strategic planning and tactical execution of information security initiatives and controls within assigned business units to improve resilience, compliance, and risk management outcomes. Work closely with architects, functional area specialists, and security staff to ensure adequate security solutions are in place throughout all IT systems and platforms to mitigate identified risks sufficiently, and to meet business objectives and regulatory requirements. Facilitates and coordinates the integration of the business-related security risk requirements into the broader governance structures by initiating relevant discussions and ensuring the evidencing of key risk-related decisions. Tracks and reports risk management trends, opportunities, and remediation monthly and provides updates to the Security team Create and maintain reporting, problem resolution, and other tasks necessary for continuous improvement and evolution of services. Manage stakeholders at all levels within assigned business units, building strong relationships and promoting a security-aware culture that gives the business confidence that material information security risks are identified, understood, and addressed.

Qualifications, Experience and Skills

Relevant tertiary qualification (Degree / Honours) in Information Security, Cybersecurity, Information Technology, or a related discipline. 6-8 years’ experience in information security, cybersecurity, or IT and Cyber risk, with demonstrated experience in delivering security programmes, remediation initiatives, or resilience improvements across complex environments Strong knowledge of frameworks such as NIST CSF, ISO/IEC 27001 and COBIT, together with the ability to translate strategy into prioritised roadmaps, measurable outcomes and executive reporting, is essential. Experience in financial services, cyber resilience, cloud security, third-party risk, incident preparedness and security assurance will be advantageous Relevant certifications such as CISSP, CISM, CRISC or CISA are preferred. Working understanding of cloud services and best practices. Cloud Certifications an advantage: AWS Cloud Practitioner, AWS Certified Security - Specialty or related. Agile training and knowledge of Agile Frameworks. Strong analytical & problem-solving skills and facilitation, negotiation, conflict resolution skills. Experience in analyzing security and assurance reports: Penetration Testing Reports, Vulnerability Scans, SOC 2 Type 2 Reports, etc. Excellent written & oral communication and networking skills A motivated self-starter, capable of working on own initiative with a high level of integrity. A resourceful, proactive, and confident communicator ensuring adequate quality and timely deliverables. Ability to work professionally and constructively as a leader and team member providing advice and consultancy.

Skills Action Planning, Analytics Software, Budget Management, Computer Literacy, Data Analysis, Database Reporting, Data Compilation, Data Controls, Data Interpretations, Evaluating Information, Management Reporting, Numerical Aptitude, Report Review, Solution Analysis Competencies Business Insight Courage Decision Quality Ensures Accountability Financial Acumen Instills Trust Manages Complexity Optimizes Work Processes

Education NQF Level 9 - Masters

Closing Date 24 September 2026 , 23:59 The appointment will be made from the designated group in line with the Employment Equity Plan of Old Mutual South Africa and the specific business unit in question.

The Old Mutual Story!

Old Mutual is a premium African financial services organisation that offers a broad spectrum of financial solutions to retail and corporate customers across key market segments in 14 countries. The lines of business include Life and Savings, Property and Casualty, Asset Management and Banking and Lending. We are rooted in our purpose of Championing Mutually Positive Futures Every Day and believe that a great customer experience is anchored in a great employee experience.