EXPERIENCE

• Minimum 5-7 years of experience in cyber risk, operational resilience, or technology risk in a financial or regulated setting.
• Experience leading or supporting regulatory readiness efforts across large-scale organisations.
• Proven track record of managing senior stakeholders and driving delivery in high-pressure environments.
• Hands-on involvement in resilience strategy, scenario testing, or third-party oversight.
• Experience with governance documentation, including policy writing, control definition, and audit trail creation.

KNOWLEDGE

Regulatory frameworks such as DORA, PRA/FCA outsourcing guidelines, EU AI Act, and cybersecurity legislation.
Understanding of threat intelligence, cyber incident response planning, and IT governance controls.
Experience with third-party risk due diligence and control assurance approaches.
Awareness of software development and cloud infrastructure risks, particularly in managed service environments.
Exposure to AI/ML technologies, with working knowledge of associated data risks and privacy challenges.
Strong appreciation of enterprise IT architectures and how operational risk intersects with them.

SKILLS

• Strong understanding of operational resilience, cyber risk, and third-party risk management frameworks (eg DORA, NIST, ISO 27001).
• Proven ability to engage and influence stakeholders at all levels including CIOs, BSOs, and senior directors.
• Ability to operate autonomously and deliver outcomes without heavy supervision.
• Familiarity with AI risk governance frameworks and associated regulatory expectations.
• Strong written and verbal communication skills, especially for reporting, policy review, and risk documentation.
• Analytical mindset, with the ability to identify interdependencies and assess complex risk scenarios.
• Comfort navigating ambiguity and adapting to evolving regulatory and organisational contexts.

PURPOSE OF THE ROLE

To provide senior-level cover for a cyber risk and resilience role during a period of internal transition. The role will take ownership of critical workstreams across third-party and technology risk, maintain continuity on regulatory readiness (eg DORA), and ensure ongoing alignment with cyber risk frameworks and stakeholder expectations.

The successful candidate will be expected to operate autonomously, manage relationships with key technology and security teams across entities, and drive outcomes related to control effectiveness, regulatory submissions, and AI/cyber governance maturity. This role will also support proactive scenario testing and contribute to strengthening the group's operational resilience capabilit