IT Risk Manager

Momentum Group is a South African-based financial services group. Our retail and specialist brands drive to build and protect our client's financial dreams. We help people grow their savings, protect what matters to them and invest for the future. We help companies and organisation’s care for and reward their employees and members.

Momentum Group is one of South Africa's largest life insurers and integrated financial services companies, operating through brands like Momentum, Metropolitan, Guardrisk, and Eris Properties. Through our own network of advisers or via independent brokers and utilising new platforms Momentum Group provides practical financial solutions for people, communities, and businesses.

Visit us at

As an applicant, please verify the legitimacy of this job advert on our company career page.

The IT Risk Manager is responsible for leading the identification, assessment, monitoring, and reporting of technology risks across the organisation, ensuring that technology risks are effectively governed in line with the Group Digital and Technology’s risk appetite, regulatory obligations, and strategic objectives. The role has primary accountability for IT and technology risk and secondary accountability for operational risks that arise from, or are enabled by, technology, data, automation, and system-dependent business processes.

The incumbent will act as a key risk partner to technology, data, security, and business teams, translating technical risk into clear business impact for senior decision-makers.

• Bachelor’s degree in a relevant field (Information Systems / Computer Science / Informatics / Engineering / Accounting with IT focus, etc.)
• 5 years relevant experience in technology risk / IT audit / risk assurance, with at least 2–3 years in an audit firm (Big 4 or reputable mid-tier) strongly preferred.
• Demonstrated experience in:
• Technology risk assessments and controls testing
• Audit-style documentation and remediation tracking
• Senior stakeholder engagement and reporting
• Exposure to at least one of: AI/data programmes, cloud transformation, advanced analytics initiatives, or digital platform delivery.
• Professional Certifications (advantageous)
• CRISC – Certified in Risk and Information Systems Control
• CISA – Certified Information Systems Auditor
• CISM – Certified Information Security Manager
• Other relevant governance, risk, or technology certifications

• Lead enterprise-level IT and technology risk assessments across infrastructure, applications, cloud environments, data platforms, and digital solutions.
• Identify, assess, and monitor risks relating to:
• IT General Controls (access management, change management, IT operations)
• Application and automated controls
• System availability, resilience, and recoverability
• Cyber and information security governance (in partnership with Security teams)
• Evaluate control design and operating effectiveness using audit-grade methodologies, including evidence standards, sampling, issue grading, and remediation tracking.
• Maintain a structured view of inherent risk, control effectiveness, residual risk, and risk acceptance.
• Ensure alignment of technology risk assessments to recognised governance and control frameworks (e.g. COBIT, ISO-aligned practices, NIST-informed approaches).

• Identify and assess operational risks that are driven or amplified by technology, including risks arising from:
• System dependency and manual workarounds
• Process automation and digitisation
• Data quality and integrity
• Technology-supported decision-making and analytics
• Evaluate business process failure scenarios where technology breakdowns, control weaknesses, or poor system design could lead to:
• Financial loss
• Customer harm
• Regulatory breaches
• Operational disruption or service degradation
• Classify technology risks in line with the organisation’s Operational Risk taxonomy, ensuring consistency in impact, likelihood, and appetite measurement.
• Partner with Operational Risk and Business teams to ensure appropriate risk ownership, monitoring, and remediation for…