IT and Cybersecurity Risk Manager

Old Mutual Life Assurance Company (SA) Ltd (PFA); Johannesburg; On-site; ZAR 1,500,000 - 1,900,000; Full time

Job summary

Old Mutual Life Assurance Company (SA) Ltd (PFA) in Johannesburg seeks an experienced professional to provide independent oversight of cybersecurity and IT risk within a major financial services group. You will challenge 1st and 2nd line risk activities, lead thematic risk analyses and ensure regulatory reporting timelines are met.

The role emphasizes cloud, identity, data protection and resilience, with collaboration across risk, compliance and IT teams to reduce risk and strengthen controls.

Qualifications

• Bachelor's degree in information systems, computer science, information security, risk management or related field.
• Honours or postgrad qualification is advantageous.
• 5-8 years in IT risk, cybersecurity, IT audit or technology governance.
• At least 3 years in a 2nd line risk role or equivalent.

Responsibilities

• Provide independent oversight of cybersecurity risk management framework and controls.
• Review 1st line risk and control self-assessments for tech, cyber and data.
• Perform deep dives on high-risk areas like identity, cloud and data leakage.
• Monitor risk acceptances and ensure timely remediation.
• Oversee cyber incident management and regulatory reporting timelines.
• Challenge third-party and cloud risk management, including vendor security obligations.

Skills

IT risk

Cybersecurity

IT audit

Governance

Cybersecurity certs CISSP CISA CISM CC

Education

Bachelor's degree in information systems or related field

Honours or postgraduate qualification advantageous

Tools

Regulatory frameworks

Job description

Let's Write Africa's Story Together! Old Mutual is a firm believer in the African opportunity and our diverse talent reflects this.

Job Description

Risk Oversight and Independent Challenge

• Provide independent oversight of the cybersecurity risk management framework and the effectiveness of first-line cybersecurity controls.
• Review and challenge 1st line risk and control self-assessments (RCSAs) for technology, cyber and data.
• Perform thematic deep dives on high-risk areas: identity and privileged access, cloud, ransomware resilience, legacy platforms, data leakage.
• Issue independent risk opinions on major change: core system replacements, cloud migrations, new digital channels, AI use cases.
• Monitor emerging cybersecurity risks, including artificial intelligence-enabled attacks, identity compromise, supply-chain attacks and evolving fraud techniques.
• Track risk acceptances and exceptions; challenge those that are expired, open-ended or above appetite.

Cyber Resilience and Incident Oversight

• Oversee cyber incident management and confirm material incidents are reported to the Prudential Authority within regulatory timelines.
• Review penetration test, red team and vulnerability results for root causes and systemic themes, not single findings.
• Assess IT disaster recovery and cyber recovery test outcomes against business-defined RTOs and RPOs, together with BCM.
• Participate in and challenge the design of, cyber crisis simulations at executive level.

Third-Party and Cloud Technology Risk

• Provide 2nd line oversight of technology and cyber risk in material outsourcing and cloud arrangements.
• Assess the adequacy of first-line third-party risk management processes for technology and cybersecurity risks.
• Review the adequacy of contractual security obligations, audit rights, incident notification requirements, service continuity arrangements and exit provisions.
• Challenge vendor security due diligence, contract clauses (audit rights, breach notification, exit) and ongoing monitoring.
• Monitor concentration risk across critical technology providers.

IT Change, Projects and Emerging Technology Risks

• Provide independent risk oversight of material technology programmes, digital transformation initiatives, application modernisation and infrastructure changes.
• Assess whether technology risks are identified and addressed throughout project initiation, design, development, testing, deployment and post-implementation review.
• Challenge the adequacy of security-by-design, privacy-by-design, change governance and independent security approval arrangements.
• Review the management of material project risks, including delivery dependencies, scope changes, control gaps and unresolved security issues.
• Challenge the acceptance of material residual risks associated with go-live decisions and technology exceptions.
• Monitor whether material technology projects are delivering the agreed risk reduction and control improvement

Monitoring, Reporting and Governance

• Produce the quarterly Cyber and IT Risk Report for the Executive Risk Committee(s): posture, KRIs against appetite, top risks, incidents, overdue remediation.
• Present to committees and translate technical exposure into business, financial and regulatory impact.
• Track audit, regulatory and 2nd line findings to closure and validate remediation evidence.
• Monitor the timely remediation of IT and cybersecurity findings arising from Internal Audit, external assurance reviews, regulatory inspections and independent assessments.

Regulatory Engagement and Combined Assurance

• Interpret new and changing regulations and assess OMI's gap position.
• Support regulatory gap assessments, compliance monitoring, management reporting and remediation tracking.
• Assess the adequacy of first-line arrangements for implementing relevant regulatory obligations and internal policies.
• Prepare and support responses to Prudential Authority and FSCA information requests, onsite reviews and thematic surveys.
• Participate in combined assurance with Internal Audit, compliance and external audit.

Qualifications required

Bachelor's degree in information systems, Computer Science, Information Security, Risk Management or related field (NQF 7). Honours or a postgraduate qualification is advantageous.

Professional Certifications

• Cyber and security: CISSP, CISA, CISM, CCSP
• Risk and governance: CRISC, CGEIT, COBIT 2019

Experience, skills and knowledge required

• 5-8 years in IT risk, cybersecurity, IT audit or technology governance.
• At least 3 years in a 2nd line role (or an equiv