IT and Cybersecurity Risk Manager

Old Mutual is currently inviting applications for an IT and Cybersecurity Risk Manager to join their team in Johannesburg. As a major player in the financial services sector, the organisation places a heavy emphasis on robust digital protection and operational resilience. This role sits at the intersection of technology, risk oversight, and regulatory compliance, offering the right candidate a chance to influence the security posture of one of South Africa’s most established financial institutions.

About the role

This position is a Second Line of Defence function, tasked with providing independent oversight and critical challenge to the cybersecurity and technology risk management frameworks. You will not be responsible for day-to-day IT service delivery; instead, your focus is on ensuring that the internal teams—who own the risks—are operating within the company’s defined risk appetite.

You will act as an advisor and a watchdog, assessing the efficacy of control self-assessments, cloud migration strategies, and the security of emerging technologies like AI. A significant portion of the role involves stakeholder management, as you will be required to translate complex, technical security risks into clear business impacts for Executive Risk Committees.

Your daily responsibilities will revolve around proactive monitoring and strategic governance. You will be expected to:

• **Risk Oversight:** Provide critical reviews of cybersecurity frameworks, challenge risk acceptances, and perform deep-dive thematic reviews on high-risk areas like ransomware resilience, data leakage, and privileged access management.
• **Incident and Resilience Management:** Oversee the integrity of incident response processes and disaster recovery testing, ensuring that business continuity plans remain robust against real-world threats.
• **Third-Party and Cloud Governance:** Assess the security obligations of external vendors and cloud service providers, monitoring concentration risks and ensuring that contractual security clauses are enforced.
• **Regulatory Liaison:** Interpret evolving regulatory requirements from bodies such as the Prudential Authority and FSCA, managing gap assessments and preparing evidence for audits and supervisory reviews.
• **Change Management:** Provide risk-based opinions on major digital transformation initiatives and core system replacements to ensure that "security-by-design" principles are not overlooked during rapid innovation.

What they're looking for

Old Mutual is seeking a seasoned professional with a deep technical foundation and the ability to influence leadership. You should possess:

• **Academic and Professional Credentials:** A minimum NQF 7 qualification in Information Systems, Computer Science, or a related field. Relevant certifications such as CISSP, CISM, CRISC, or CISA are highly desirable.
• **Experience:** 5 to 8 years in IT risk, cyber-governance, or IT audit, with at least 3 years specifically in a second-line oversight capacity within the financial services sector.
• **Technical Literacy:** Hands-on knowledge of cloud environments (AWS, Azure, or GCP) and modern security operations is essential for credible challenge.
• **Soft Skills:** Proven ability to communicate technical exposure to senior stakeholders, combined with a leadership mindset ready to drive a small team toward strategic objectives.

For a professional in this niche, salaries in South Africa typically reflect the high-stakes nature of the financial sector, often ranging from R900,000 to R1.4 million per annum, depending on seniority and specific certifications held. Candidates transitioning into this role from a Big 4 risk advisory background are often well-positioned for the "independent challenge" nature of this function. Success in this position serves as a strong stepping stone toward Head of Risk, CISO, or broader IT Governance executive paths within the corporate financial landscape.

Qualifications required:

• Bachelor’s degree in information systems, Computer Science, Information Security, Risk Management or related field (NQF 7). Honours or a postgraduate qualification is advantageous.

 

Professional Certifications

• Cyber and security: CISSP, CISA, CISM, CCSP
• Risk and governance: CRISC, CGEIT, COBIT 2019

 

Experience, skills and knowledge required:

• 5–8 years in IT risk, cybersecurity, IT audit or technology governance.
• At least 3 years in a 2nd line role (or an equivalent oversight role in Big 4 technology risk advisory).
• At least 3 years in financial services; insurance strongly preferred, banking acceptable.
• Demonstrable experience presenting to Senior Management.
• Practical exposure to Prudential Authority or FSCA reviews, or to equivalent regulators.
• Hands-on familiarity with cloud (Azure, AWS or GCP), identity and access management, and modern security operations, enough to challenge credibly.
• Experience with a GRC platform (e.g. ServiceNow IRM, Archer, MetricStream) is advantageous.
• People leadership experience, or a clear readiness to build and lead a small team.

Competencies required:

• Execution
• Collaboration (Relating)
• Innovation (Perspective)
• Leading with Influence
• Personal Mastery (Learning)
• Strategic

The Recruitment Process:

 

• TA Interview: This will be a discussion with our Senior Talent Acquisition Specialist to give you an understanding of our business, our culture & values and more context on the role. It will also allow us the opportunity to get to know you more and ensure OMI can meet your career aspirations.
• Panel Interview: This will be with 2 members of the Senior Leadership of the Hiring Team and 1 member of the HC Senior Team.
• Technical & Psychometric Assessments: These will depend on the role and will sometimes happen concurrently with Vetting through an external service provider, as well as Internal Verification.
• Final Feedback.

 

All About OMI:

 

https://www.oldmutual.co.za/about/old-mutual-insure/ 

 

Please note that, unfortunately, we cannot accept any applications after the closing date

 

Skills

Contract Administration, Contract Management, Cyber Risks, Cybersecurity Controls, Cybersecurity Risk Management, Data Compilation, Financial Acumen, Information Retrieval, Information Technology (IT) Risk, Legal Communication, Negotiation, Network Optimization, Oral Communications, Report Review, Requirements Management, Supplier Management, Technology Risk, Third Party Risk Management, User Experience (UX) Design

Competencies

Action Oriented

Business Insight

Collaborates

Communicates Effectively

Courage

Cultivates Innovation

Customer Focus

Decision Quality

Education

Bachelor of Commerce (BCom): Information Technology And Computer Science: Information Technology Management (Required), NQF Level 7 - Degree, Advance Diploma or Postgraduate Certificate or equivalent

Closing Date

11 November 2026 , 23:59

The appointment will be made from the designated group in line with the Employment Equity Plan of Old Mutual South Africa and the specific business unit in question.

The Old Mutual Story!