IT and Cybersecurity Risk Manager

Let's Write Africa's Story Together!

Old Mutual is a firm believer in the African opportunity and our diverse talent reflects this.

This function manages the delivery of IT services to clients or internal stakeholders. The IT and Cybersecurity Risk Manager is responsible for negotiating, developing, monitoring, and managing service level agreements relating to IT services and ensuring that these are met. They also ensure that all processes, agreements and contracts are appropriate for the agreed service level targets.

• →Provide independent oversight of the cybersecurity risk management framework and the effectiveness of first-line cybersecurity controls.
• →Review and challenge 1st line risk and control self-assessments (RCSAs) for technology, cyber and data.
• →Perform thematic deep dives on high-risk areas: identity and privileged access, cloud, ransomware resilience, legacy platforms, data leakage.
• →Issue independent risk opinions on major change: core system replacements, cloud migrations, new digital channels, AI use cases.
• →Monitor emerging cybersecurity risks, including artificial intelligence-enabled attacks, identity compromise, supply-chain attacks and evolving fraud techniques.
• →Track risk acceptances and exceptions; challenge those that are expired, open-ended or above appetite.

• Oversee cyber incident management and confirm material incidents are reported to the Prudential Authority within regulatory timelines.
• Review penetration test, red team and vulnerability results for root causes and systemic themes, not single findings.
• Assess IT disaster recovery and cyber recovery test outcomes against business-defined RTOs and RPOs, together with BCM.
• Participate in and challenge the design of, cyber crisis simulations at executive level.

• Provide 2nd line oversight of technology and cyber risk in material outsourcing and cloud arrangements.
• Assess the adequacy of first-line third-party risk management processes for technology and cybersecurity risks.
• Review the adequacy of contractual security obligations, audit rights, incident notification requirements, service continuity arrangements and exit provisions.
• Challenge vendor security due diligence, contract clauses (audit rights, breach notification, exit) and ongoing monitoring.
• Monitor concentration risk across critical technology providers.

• Provide independent risk oversight of material technology programmes, digital transformation initiatives, application modernisation and infrastructure changes.
• Assess whether technology risks are identified and addressed throughout project initiation, design, development, testing, deployment and post-implementation review.
• Challenge the adequacy of security-by-design, privacy-by-design, change governance and independent security approval arrangements.
• Review the management of material project risks, including delivery dependencies, scope changes, control gaps and unresolved security issues.
• Challenge the acceptance of material residual risks associated with go-live decisions and technology exceptions.
• Monitor whether material technology projects are delivering the agreed risk reduction and control improvement

• Produce the quarterly Cyber and IT Risk Report for the Executive Risk Committee(s): posture, KRIs against appetite, top risks, incidents, overdue remediation.
• Present to committees and translate technical exposure into business, financial and regulatory impact.
• Track audit, regulatory and 2nd line findings to closure and validate remediation evidence.
• Monitor the timely remediation of IT and cybersecurity findings arising from Internal Audit, external assurance reviews, regulatory inspections and independent assessments.

• Interpret new and changing regulations and assess OMI’s gap position.
• Support regulatory gap assessments, compliance monitoring, management reporting and remediation tracking.
• Assess the adequacy of first-line arrangements for implementing relevant regulatory obligations and internal policies.
• Prepare and support responses to Prudential Authority and FSCA information requests, onsite reviews and thematic surveys.
• Participate in combined assurance with Internal Audit, compliance and external audit.

• Bachelor’s degree in information systems, Computer Science, Information Security, Risk Management or related field (NQF 7). Honours or a postgraduate qualification is advantageous.

• Cyber and security: CISSP, CISA, CISM, CCSP
• Risk and governance: CRISC, CGEIT, COBIT 2019

• 5–8 years in IT risk, cybersecurity, IT audit or technology governance.
• At least 3 years in a 2nd line role (or an equivalent oversight role in Big 4 technology risk advisory).
• At least 3 years in financial services; insurance strongly preferred, banking acceptable.
• Demonstrable experience presenting to Senior Management.
• Practical exposure to Prudential Authority or FSCA reviews, or to equivalent regulators.
• Hands-on familiarity with cloud (Azure, AWS or GCP), identity and access management, and modern security operations, enough to challenge credibly.
• Experience with a GRC platform (e.g. ServiceNow IRM, Archer, MetricStream) is advantageous.
• People leadership experience, or a clear readiness to build and lead a small team.

• Execution
• Collaboration (Relating)
• Innovation (Perspective)
• Leading with Influence
• Personal Mastery (Learning)
• Strategic

• TA Interview: This will be a discussion with our Senior Talent Acquisition Specialist to give you an understanding of our business, our culture & values and more context on the role. It will also allow us the opportunity to get to know you more and ensure OMI can meet your career aspirations.
• Panel Interview: This will be with 2 members of the Senior Leadership of the Hiring Team and 1 member of the HC Senior Team.
• Technical & Psychometric Assessments: These will depend on the role and will sometimes happen concurrently with Vetting through an external service provider, as well as Internal Verification.
• Final Feedback.

https://www.oldmutual.co.za/about/old-mutual-insure/ 

Please note that, unfortunately, we cannot accept any applications after the closing date

The appointment will be made from the designated group in line with the Employment Equity Plan of Old Mutual South Africa and the specific business unit in question.

The Old Mutual Story!