Head of Risk & Resilience

Monese; United Kingdom; Hybrid; GBP 120,000 - 180,000; Full time

Benefits offered by this job

Hybrid working

30 days abroad per year

25 days annual leave

Private medical with Confido

Bupa private healthcare

Learning & development budget

Share options

VIP Monese accounts

Social events

Job summary

Monese seeks a hands-on Head of Risk & Operational Resilience to own, build, and run operational resilience, wind-down, and third-party risk management in line with FCA/DORA expectations. This role is build-and-run, initially individual contributor, with growth into a broader risk function.

You will develop risk management toolkit, KRIs, control self-assessment, and incident management processes while ensuring robust exit strategies for critical vendors.

Qualifications

• Experience running KRI/CSA frameworks across operational risk domains.
• Practical DORA implementation experience (incident reporting, third-party risk).
• Hands-on incident management and resilience testing experience.
• Outsourcing/TPRM experience including due diligence and exit strategies.
• Track record leading second-line operational/prudential risk functions in UK-regulated payments or banking.

Responsibilities

• Own the operational resilience framework, including wind-down planning and business continuity.
• Lead TPRM risk assessments and ensure due diligence for critical vendors.
• Maintain a risk event log and KRIs with escalation and remediation tracking.
• Serve as audit liaison for wind-down, incident management and TPRM matters.
• Provide risk MI to Risk Committee and Board; align controls with audit recommendations.

Skills

KRI framework

CSA framework

Audit liaison

Job description

• Lead a high-impact resilience build! Transform our operational resilience, TPRM, and Wind-Down frameworks and shape the future of a secure business built for millions
• Reports to: Group Chief Compliance & Risk Officer / MLRO
• Function: Second line risk, independent of the FinCrime/AML line (Deputy MLRO)
• We are looking for a hands-on Head of Risk & Operational Resilience to own, build, and run our operational and prudential risk capabilities across Monese
• In this role, you will be the accountable owner for our operational resilience framework- specifically focusing on wind-down planning, business continuity, incident management, and third-party/outsourcing risk management in accordance with FCA expectations and DORA standards
• This is a build-and-run, individual contributor role initially. You will close current resourcing gaps across all three areas and build the underlying risk management toolkit (KRIs, control self-assessment, risk event log) needed to run them sustainably
• Own the Risk & Control Self-Assessment process and a KRI framework across all operational areas
• Maintain an operational risk event log with clear escalation, investigation, and remediation tracking
• Act as primary liaison for internal and external audit on wind-down, incident management, and TPRM matters; align control design with audit recommendations
• Regulatory basis: DORA Art. 28–44; EBA/GL/2019/02; FCA SYSC 8; Operational Resilience (PS21/3), including mapping of third parties supporting important business services
• Own the Third Party Risk Management framework, running rigorous risk assessments, ensuring due diligence is performed, maintaining the DORA Register of Information, and guaranteeing that robust exit strategies are in place for critical vendors
• Ensure TPRM aligns with BCP maintaining the mapping of critical third parties against important business services
• Regulatory basis: Electronic Money Regulations 2011; EBA/GL/2021/11
• Map out critical business services and be the primary author of the firm’s board- and FCA-approved Wind-Down Plan (WDP) and Business Continuity Plans (BCP), ensuring the firm can weather operational crises without harming consumers
• Design and run the WDP and BCP testing programme - scenario testing, timeline/resource feasibility checks, and business impact analysis - evidencing the plan works operationally, not just that it exists
• Benchmark against the FCA’s 2025 multi-firm WDP review and the shift in supervisory tone (e.g. PS25/12) from document-existence to demonstrated execution capability
• Feeds risk MI into the Risk Committee and Board reporting owned by the CCRO/MLRO
• Collaborate with the Deputy MLRO on third-party or incident matters with a financial-crime dimension, without owning fincrime risk itself

Benefits

• Hybrid working and 30 days work abroad per year
• 25 days annual leave, plus public holidays, plus an extra day every year worked
• Sports compensation with Stebby or direct discount from a gym
• Bupa personal private healthcare
• 10 paid sick days per year
• Learning & development budget and 10 paid learning days per annum
• VIP Pockit & Monese accounts
• Share options (exact details depending on your role and level)
• Social events throughout the year
• Private medical with Confido

• Experience running KRI/CSA frameworks and acting as an audit liaison
• Practical DORA implementation experience (Art. 17–23 incident reporting; Art. 28–44 third-party risk), given Monese’s EU entity exposure
• Hands-on incident management and resilience testing experience - able to design and run simulation exercises, not just write policy
• Outsourcing/TPRM experience including fourth-party due diligence
• Direct experience with wind-down/recovery planning under EMR 2011/PSR 2017 or equivalent prudential regimes
• Track record building or running a second-line operational/prudential risk function in a UK-regulated payments, e-money, or banking firm
• Comfortable operating with limited team resource initially - this is a build-out role