Johan Marais

Business-aligned Information Security and IT Risk leader with 25+ years of financial-services experience, known for building resilient, compliant, and strategically aligned security capabilities that enable business growth. I specialise in developing enterprise security strategies, leading risk-based decision making, and embedding governance, resilience, and accountability across complex organisations. I excel at bridging the gap between technology, business, and risk, building high-trust relationships with executives, and guiding cross-functional teams to strengthen cybersecurity posture.

My passion lies in designing and implementing security frameworks, improving organisational maturity, and enabling secure digital transformation in line with business risk appetite.

Head of Information Security and IT Risk at Momentum Investments Group (2022-01 – Present)

Lead the Information Security, IT Risk, and Business Continuity functions, acting as a strategic partner to business leadership to embed security, risk management and resilience into enterprise and investment platforms.

• Partner with executives and business units to translate cyber risk and IT risk into business decisions, aligning security controls to risk appetite and commercial objectives
• Define and drive a structured IT risk management framework, including risk identification, assessment, prioritisation, and reporting aligned to enterprise risk practices
• Drive a business-aligned security and IT risk strategy and roadmap, supporting digital transformation and platform re-architecture initiatives
• Embed security and risk practices into product, operations, and data governance frameworks
• Lead business continuity and resilience strategy, including crisis response capability
• Strengthen compliance with POPIA, ISO 27001, and regulatory expectations, while enabling delivery velocity
• Act as a key advisor in major transformation programmes, ensuring secure-by-design implementation

Head of Operations at Momentum Life (2019-01 – 2022-12)

I improved the business by establishing and centralizing the following capabilities to ensure continuous effective business delivery: Managing and monitoring of business processes, manage the business exposures, risks and compliance, data governance, data security, access management, business continuity, incident and problem management. Key stakeholder on a strategic replatform and migration project.

Risk Manager (Operations and IT) at Momentum Life (2018-01 – 2019-12)

Lead the business, operational and IT risk portfolio to provide overall strategic leadership to ensure that risks are identified, measured, and managed within acceptable tolerance levels.

IT Operations Manager at Momentum Life (2017-01 – 2018-12)

Embedded IT Risk management, Information security and controls, Manage IT operations, Business continuity/Disaster recovery, Projects.

IT Security Manager at Investec (2016-01 – 2017-12)

Implement systems and controls to manage security risks and threats:

• Identify and protect critical information assets from theft, loss or unauthorized access through the delivery of security and technology solutions.
• Improve the overall risk posture/ Support business objectives and initiatives.
• Endpoint security responsibilities include the following: Vulnerability Management, Host based Intrusion Detection/Prevention systems, Security Information & Event Management (SIEM) platform, Data Loss Prevention (DLP), and antivirus.
• Develop standards, best practices & guidelines.
• Overseeing the business continuity planning (BCP) for IT Security.

IT Risk Manager at Momentum (2015-01 – 2016-12)

Drive the identification and management of IT and Information security risk.

• Continuous monitoring - I head up a monitoring area that is responsible for the continuous monitoring related to security breaches and other internal control environments.
• Business Continuity/ Disaster recovery
• IT Risk community - Co-ordinate IT Risk forum across MMH Group wide

Manager – Forensic Technology Solutions at Momentum Group (2013-01 – 2015-12)

• Responsible for managing a team of Business Analysts, Data Analysts and system developers that are responsible for the development of forensic and risk services within the MMI group.
• Services including: User and entity behavior analytics, compliance monitoring, anti-money laundering (AML), Key Risk Indicators (KRI) and Key Control Indicators (KCI).

Senior Business and System Analyst (Enterprise Risk) at Momentum Group (2010-01 – 2013-12)

• Successfully pioneered the implementation of an innovative Network Forensics Technology (NFT) system for the establishing of a proactive fraud prevention capability.
• User and entity behavior analytics
• Helping business units to solve complex business issues.
• Focus on improving and maintaining continuous monitoring systems for the tracking of key risk and control indicators to several stakeholders including Operational Risk Management, Compliance, Forensics and Financial Control.
• This IT implementation area was incorporated into the Forensics department and I was promoted to the team leader for the Forensic Technology Solutions team on 1 June 2013.

BI Business Analyst / BA Team Lead / Actuarial Data Specialist at Momentum Group (2007-01 – 2010-12)

Delivered MIS dashboards, led BA functions, and enabled actuarial valuation modelling and data structures.

Business Analyst at Momentum Group (2003-01 – 2007-12)

Worked on major data migrations, product models, and actuarial data architecture.

Data Integrity Specialist, Broker Services, Test Analyst at Momentum Group (2000-01 – 2003-12)

Improved data quality, supported financial advisors, and led testing on complex migration projects.

Course in AI Risk and Cyber security – Udemy (2024-01)

Course in Risk Management for Cybersecurity and IT managers – Udemy (2022-01)

Programme in Developing Team Leaders (DTL) – Investec (2017-01)

Course in Proactive Network Defence – MWR InfoSecurity (2017-01)

Training in PCI DSS Implementation training – LiquidNexxus (2011-01)

Certificate in Data warehouse – Kimball University (2008-01)

Series in Business Analysis series – Guruhut (2004-01)

Higher Certificate in Financial Markets and Instruments – Academy of financial Markets (2003-01)

Course in Software Testing for Business Analyst and Quality Assurance – Test and Data (2003-01)

Programme in Business and System Analysis – University of Pretoria (2002-01)

Certificate in Life Assurance Practice – University of Pretoria (1999-01)

Certificate in Bible school – Agape (1997-01 – 1998-12)

Matric – Hoerskool Zwartkop (1996-01)