Data Governance and Privacy Manager

About the role

The Data Governance and Privacy Manager establishes, leads and maintains independent second-line oversight of data governance, data risk, data quality and privacy compliance across Old Mutual Insurance (OMI). The role challenges first-line operational teams (IT, Data Architecture, Engineering, Underwriting, Claims and Operations) while ensuring alignment with South African regulatory requirements such as POPIA, so that OMI manages data as a strategic and compliant asset.

Key responsibilities

• Develop, maintain and embed the Data Risk Management Framework, policy and standards, and define the data risk taxonomy; propose risk appetite, KRIs and tolerance thresholds.
• Review and challenge first-line risk and control self-assessments, oversee Data Protection Impact Assessments, evaluate data controls and track data risk incidents to closure.
• Oversee data quality, lineage, traceability, reconciliation, data migration and the reliability of management information and regulatory submissions.
• Provide independent oversight of data protection and privacy risks, including data classification, access governance, cross-border transfers and outsourced processing, in collaboration with Privacy, Legal, Compliance and Information Security.
• Identify and prioritise critical data assets, assess data resilience and backup, and cover third-party, outsourcing and cloud data risks.
• Monitor risk findings, challenge remediation plans, validate evidence of completion and escalate unresolved risks to governance forums.

Required profile

• Bachelor's degree in information systems, data management, computer science, risk management, information security, statistics, business or a related discipline; a postgraduate qualification in a related field is advantageous.
• At least 6-8 years of experience in data risk, IT risk, information governance, data governance, information security or technology risk.
• Advantageous: certifications such as CISA, CRISC, CDMP, CIPP/E or CIPM; exposure to AI governance, model risk or automated decision-making risk.

Applications close on 11 November 2026. The process includes a TA interview, panel interviews, technical and psychometric assessments and vetting.