Security Governance and Risk Lead

Old Mutual Life Assurance Company (SA) Ltd; Cape Town; On-site; ZAR 1,200,000 - 2,000,000; Full time

Job summary

Old Mutual Life Assurance Company (SA) Ltd is seeking a Security Governance and Risk Lead to drive the Group Information Security Governance Framework, risk management, and regulatory compliance across business clusters. The role ensures alignment with Group security requirements and provides independent oversight.

The position requires 8–10 years in information security, governance, and risk, with at least 3 years in a management role, and strong leadership and stakeholder skills.

Qualifications

• 8-10 years of experience in information security, governance, risk management, cyber resilience, technology risk, or related control functions.
• 3+ years in a management role.
• Experience developing, implementing, and maintaining enterprise-wide security governance frameworks, policies, standards, control libraries, and risk methodologies.
• Experience in financial services or other highly regulated environments with regulators, risk committees, audit teams, and executive leadership.
• Strong knowledge of information security governance, risk, controls, assurance, and cyber resilience frameworks.

Responsibilities

• Develop, maintain, and continuously improve the Group Information Security Governance Framework.
• Define security governance operating models, forums, decision rights, and escalation paths across the Group.
• Maintain Group-wide information security principles, policies, standards, procedures, control requirements, and governance artefacts.
• Drive adoption of consistent governance practices across clusters, technology teams, and security functions.
• Provide independent oversight of cluster-level alignment to Group security requirements, governance decisions, and risk appetite.
• Define and maintain the Group’s Tight and Loose Security principles, ensuring clarity on mandatory controls and local flexibility.
• Review exception requests, deviations, and compensating controls for alignment with risk appetite.
• Monitor implementation across clusters and report compliance, deviations, and systemic issues to governance forums.
• Maintain and enhance the Information Security Policy, Standards Framework, risk management methodology, and control libraries.
• Ensure frameworks address AI security governance, cloud security governance, and cyber resilience.

Skills

Adaptive Thinking

Business Requirements Analysis

Change Management

Cultural Awareness

Current State Assessment

Data Compilation

Executing Plans

Gap Analysis

Identifying Customer Needs

Legal Practices

Policies & Procedures

Policy Development

Presenting Solutions

Readiness Assessments

Education

Masters degree or equivalent in Information Security or related field

NQF Level 9 – Masters

Job description

Let's Write Africa's Story Together! Old Mutual is a firm believer in the African opportunity and our diverse talent reflects this.

Old Mutual is a premium African financial services organisation that offers a broad spectrum of financial solutions to retail and corporate customers across key market segments in 14 countries.

Job Description

The Security Governance and Risk Lead is responsible for leading the development, implementation, maintenance, and oversight of the Group Information Security Governance and Risk Management Framework.

The role ensures that all business clusters operate within approved security principles, policies, standards, risk appetite, minimum security requirements, and regulatory obligations.

The role defines and maintains the governance structures, security frameworks, control requirements, and methodologies that guide Information Security Officers and security practitioners across the Group.

It provides independent oversight and assurance that business clusters comply with Group security requirements while operating within the organisation’s Tight and Loose Security model.

Group Technology & Transformation | IT Governance Risk & Compliance Job Description Group Security Governance

Group Security Governance

Develop, maintain, and continuously improve the Group Information Security Governance Framework.

Define security governance operating models, forums, decision rights, and escalation paths across the Group.

Maintain Group-wide information security principles, policies, standards, procedures, control requirements, and governance artefacts.

Drive adoption of consistent governance practices across business clusters, technology teams, and security functions.

Provide independent oversight of cluster‑level alignment to Group security requirements, governance decisions, and risk appetite.

Tight and Loose Security Governance

Define and maintain the Group’s Tight and Loose Security principles, ensuring clarity on mandatory controls and areas where local implementation flexibility is permitted.

Identify and classify controls that are mandatory and non‑negotiable, as well as minimum standards that allow implementation flexibility based on business context.

Review exception requests, deviations, and compensating controls to ensure decisions remain aligned to risk appetite and governance requirements.

Monitor implementation consistency across clusters and report compliance, deviations, and systemic issues to governance forums.

Security Framework Ownership

Maintain, and enhance the Information Security Policy, Security Standards Framework, Cyber Security Framework, and Security Risk Management Methodology.

Maintain security control libraries, security baselines, security assurance requirements, metrics frameworks, and exception management processes.

Define and maintain governance requirements for emerging areas including AI security governance, cloud security governance, and cyber resilience.

Ensure frameworks remain practical, risk‑based, measurable, and capable of being consistently applied by Information Security Officers and security practitioners.

Security Risk Governance

Define Group security methodologies, assessment approaches, risk appetite measures, and reporting criteria.

Ensure consistent identification, assessment, treatment, monitoring, and reporting of security risks across business clusters.

Review emerging security risk trends affecting the organisation and translate these into governance actions, control improvements, and executive insights.

Oversee security risk governance activities performed by Information Security Officers and elevate material risks, systemic control weaknesses, and unresolved risk exposures.

Information Security Oversight and Assurance

Provide governance direction, methodologies, processes, templates, and assessment approaches used by Information Security Officers across the Group.

Perform thematic reviews across clusters to identify systemic weaknesses, control gaps, maturity concerns, and areas requiring focused remediation.

Track corrective actions to closure and report governance concerns, non‑compliance issues, and risk treatment progress to appropriate forums.

Drive capability maturity improvements across the organization, with standardised ways of working across business clusters.

Develop and maintain reporting covering security maturity trends, cluster compliance scores, security risk exposure, control effectiveness, policy compliance, risk treatment progress, exception reporting, and regulatory compliance status.

Regulatory and Industry Alignment

Ensure Group security governance frameworks remain aligned to applicable regulatory, industry, and good‑practice requirements, including Joint Standard 1 of 2023, Joint Standard 2 of 2024, POPIA, NIST Cybersecurity Framework 2.0, ISO/IEC 27001, ISO/IEC 27005, ISO/IEC 42001, COBIT, CIS Critical Security Controls, and financial sector cyber resilience expectations.

Qualifications, Experience and Skills

Relevant tertiary qualification in Information Security, Cybersecurity, Information Technology, Risk Management, Governance, Audit, or a related discipline.

8 -10 years of experience in information security, governance, risk management, cyber resilience, technology risk, or related control functions.

3+ years of experience in a management role.

Proven experience developing, implementing, and maintaining enterprise‑wide security governance frameworks, policies, standards, control libraries, and risk methodologies.

Experience operating within financial services or another highly regulated environment, including engagement with regulators, risk committees, audit teams, and executive leadership.

Strong working knowledge of information security governance, technology risk, security control design, assurance practices, regulatory obligations, and cyber resilience frameworks.

Excellent leadership, stakeholder management, analytical, written communication, facilitation, negotiation, and problem‑solving skills.

Preferred Certifications

• Highly desired: CISSP, CISM, CRISC, or CGEIT.
• Advantageous: ISO/IEC 27001 Lead Auditor, COBIT Design and Implementation, ISO/IEC 42001 Lead Implementer, Certified in Risk Management Assurance (CRMA), CISA, or equivalent relevant certification.

Skills

• Adaptive Thinking
• Business Requirements Analysis
• Change Management
• Cultural Awareness
• Current State Assessment
• Data Compilation
• Executing Plans
• Gap Analysis
• Identifying Customer Needs
• Legal Practices
• Policies & Procedures
• Policy Development
• Presenting Solutions
• Readiness Assessments

Competencies

• Action Oriented
• Builds Effective Teams
• Communicates Effectively
• Cultivates Innovation
• Ensures Accountability
• Manages Complexity
• Nimble Learning
• Optimizes Work Processes

Education

NQF Level 9 – Masters

Closing Date

19 November 2026 , 23:59

The appointment will be made from the designated group in line with the Employment Equity Plan of Old Mutual South Africa and the specific business unit in question.

Old Mutual Story!

We are rooted in our purpose of Championing Mutually Positive Futures Every Day and believe that a great customer experience is anchored in a great employee experience.