Security Governance and Risk Lead at Old Mutual South Africa

Job Description

• The Security Governance and Risk Lead is responsible for leading the development, implementation, maintenance, and oversight of the Group Information Security Governance and Risk Management Framework.
• The role ensures that all business clusters operate within approved security principles, policies, standards, risk appetite, minimum security requirements, and regulatory obligations.
• The role defines and maintains the governance structures, security frameworks, control requirements, and methodologies that guide Information Security Officers and security practitioners across the Group.
• It provides independent oversight and assurance that business clusters comply with Group security requirements while operating within the organisation’s Tight and Loose Security model.
• Group Technology & Transformation | IT Governance Risk & Compliance

Job Description 

Group Security Governance

• Develop, maintain, and continuously improve the Group Information Security Governance Framework.
• Define security governance operating models, forums, decision rights, and escalation paths across the Group.
• Maintain Group-wide information security principles, policies, standards, procedures, control requirements, and governance artefacts.
• Drive adoption of consistent governance practices across business clusters, technology teams, and security functions.
• Provide independent oversight of cluster-level alignment to Group security requirements, governance decisions, and risk appetite.

Tight and Loose Security Governance

• Define and maintain the Group’s Tight and Loose Security principles, ensuring clarity on mandatory controls and areas where local implementation flexibility is permitted.
• Identify and classify controls that are mandatory and non-negotiable, as well as minimum standards that allow implementation flexibility based on business context.
• Review exception requests, deviations, and compensating controls to ensure decisions remain aligned to risk appetite and governance requirements.
• Monitor implementation consistency across clusters and report compliance, deviations, and systemic issues to governance forums.

Security Framework Ownership

• Maintain, and enhance the Information Security Policy, Security Standards Framework, Cyber Security Framework, and Security Risk Management Methodology.
• Maintain security control libraries, security baselines, security assurance requirements, metrics frameworks, and exception management processes.
• Define and maintain governance requirements for emerging areas including AI security governance, cloud security governance, and cyber resilience.
• Ensure frameworks remain practical, risk-based, measurable, and capable of being consistently applied by Information Security Officers and security practitioners.

Security Risk Governance

• Define Group security methodologies, assessment approaches, risk appetite measures, and reporting criteria.
• Ensure consistent identification, assessment, treatment, monitoring, and reporting of security risks across business clusters.
• Review emerging security risk trends affecting the organisation and translate these into governance actions, control improvements, and executive insights.
• Oversee security risk governance activities performed by Information Security Officers and escalate material risks, systemic control weaknesses, and unresolved risk exposures.

Information Security Oversight and Assurance

• Provide governance direction, methodologies, processes, templates, and assessment approaches used by Information Security Officers across the Group.
• Perform thematic reviews across clusters to identify systemic weaknesses, control gaps, maturity concerns, and areas requiring focused remediation.
• Track corrective actions to closure and report governance concerns, non-compliance issues, and risk treatment progress to appropriate forums.
• Drive capability maturity improvements across the organization, with standardised ways of working across business clusters.
• Develop and maintain reporting covering security maturity trends, cluster compliance scores, security risk exposure, control effectiveness, policy compliance, risk treatment progress, exception reporting, and regulatory compliance status.
• Regulatory and Industry Alignment
• Ensure Group security governance frameworks remain aligned to applicable regulatory, industry, and good-practice requirements, including Joint Standard 1 of 2023, Joint Standard 2 of 2024, POPIA, NIST Cybersecurity Framework 2.0, ISO/IEC 27001, ISO/IEC 27005, ISO/IEC 42001, COBIT, CIS Critical Security Controls, and financial sector cyber resilience expectations.

Qualifications, Experience and Skills

• Relevant tertiary qualification in Information Security, Cybersecurity, Information Technology, Risk Management, Governance, Audit, or a related discipline.
• 8 -10 years of experience in information security, governance, risk management, cyber resilience, technology risk, or related control functions.
• 3+ years of experience in a management role.
• Proven experience developing, implementing, and maintaining enterprise-wide security governance frameworks, policies, standards, control libraries, and risk methodologies.
• Experience operating within financial services or another highly regulated environment, including engagement with regulators, risk committees, audit teams, and executive leadership.
• Strong working knowledge of information security governance, technology risk, security control design, assurance practices, regulatory obligations, and cyber resilience frameworks.
• Excellent leadership, stakeholder management, analytical, written communication, facilitation, negotiation, and problem-solving skills.

Preferred Certifications

• Highly desired: CISSP, CISM, CRISC, or CGEIT.
• Advantageous: ISO/IEC 27001 Lead Auditor, COBIT Design and Implementation, ISO/IEC 42001 Lead Implementer, Certified in Risk Management Assurance (CRMA), CISA, or equivalent relevant certification.

Skills

• Adaptive Thinking, Business Requirements Analysis, Change Management, Cultural Awareness, Current State Assessment, Data Compilation, Executing Plans, Gap Analysis, Identifying Customer Needs, Legal Practices, Policies & Procedures, Policy Development, Presenting Solutions, Readiness Assessments

Competencies

• Action Oriented
• Builds Effective Teams
• Communicates Effectively
• Cultivates Innovation
• Ensures Accountability
• Manages Complexity
• Nimble Learning
• Optimizes Work Processes

Education

• NQF Level 9 – Masters

Closing Date

• 19 November 2026