IT and Cybersecurity Risk Manager

About the role

Old Mutual is hiring an IT and Cybersecurity Risk Manager in Johannesburg. The role manages the delivery of IT services to clients or internal stakeholders by negotiating, developing, monitoring and managing service level agreements so they are met, and ensuring that processes, agreements and contracts fit the agreed service levels. It is a second-line risk oversight position.

Key responsibilities

• Oversee the cybersecurity risk management framework and first-line controls, review and challenge risk and control self-assessments, and issue independent risk opinions on major changes such as cloud migrations and AI use cases.
• Monitor emerging risks including AI-enabled attacks, identity compromise, supply-chain attacks and evolving fraud, and track risk acceptances and exceptions.
• Oversee cyber incident management, review penetration tests, red team and vulnerability results, and assess disaster recovery and cyber recovery tests against RTOs and RPOs.
• Provide second-line oversight of outsourced and cloud arrangements, including vendor security due diligence and contractual security obligations.
• Oversight of material technology programmes, digital transformation and application modernisation, including security-by-design and change governance.
• Produce the quarterly Cyber and IT Risk Report for the Executive Risk Committee, present technical exposure in business terms, and track audit, regulatory and assurance findings to closure.
• Support regulatory engagement with the Prudential Authority and FSCA, prepare responses to information requests and take part in combined assurance with Internal Audit and compliance.

Required profile

• Bachelor's degree in information systems, computer science, information security, risk management or a related field (NQF 7); honours or postgraduate qualification advantageous.
• 5-8 years in IT risk, cybersecurity, IT audit or technology governance.
• At least 3 years in a second-line role or equivalent oversight role in Big 4 technology risk advisory.
• At least 3 years in financial services; insurance strongly preferred, banking acceptable.
• Demonstrable experience presenting to senior management and practical exposure to regulator reviews.
• People leadership experience or readiness to build and lead a small team.

Required skills

• Hands-on familiarity with cloud (Azure, AWS or GCP), identity and access management and modern security operations.
• Experience with a GRC platform (e.g. ServiceNow IRM, Archer, MetricStream) is advantageous.
• Preferred certifications: CISSP, CISA, CISM, CCSP, CRISC, CGEIT, COBIT 2019.