Technology and Data Risk Manager

Nestpensions; Greater London; Hybrid; GBP 70,000 - 90,000; Full time

Job summary

Nest is seeking a role in its second line Risk team to oversee technology, information security, cyber, data and third-party risk. You will bring technical understanding to ask the right questions, understand decisions, and provide independent challenge to support senior decision-making across ExCo, Risk Committee and the Board.

You’ll examine risks from a complex tech and outsourcing landscape, translating issues into clear risk insights, and shaping Nest’s risk posture for evolving AI and

Qualifications

• Strong knowledge of information security and technology risk across areas like access control, vulnerability management, monitoring and incident response.
• Experience with recognised frameworks ISO 27001 and NIST within complex or regulated organisations.
• Understanding of second-line risk, assurance or oversight and ability to challenge while partnering with first-line teams.

Responsibilities

• Provide second-line oversight across information security, cyber, data and key technology partners; assess risk and determine where assurance is needed.
• Turn complex technical risks into clear, actionable risk insights for senior stakeholders.
• Help Nest anticipate risks from AI, emerging tech and third-party dependencies and advise on proportionate responses.

Skills

Information security

Technology risk

Second-line risk

Third-party risk

Data risk

Tools

ISO 27001

NIST

Job description

*Please note we only accept online applications.*

Role Overview

This is an opportunity to join Nest at an exciting point in the development of our approach to technology and data risk. As a new role within our second line Risk team, you’ll have real scope to shape how we provide independent oversight and assurance across technology, information security, cyber, data and third-party risk.

You’ll work closely with specialist teams across Nest, bringing the technical understanding and curiosity to ask the right questions, understand the decisions being made and provide thoughtful, independent challenge. Rather than simply working within an established framework, you’ll have the autonomy to help design and develop our approach, turning complex technical risks into clear insight that supports senior decision-making across ExCo, Risk Committee and the Board.

A significant part of the role will be looking at the risks that come with an increasingly complex technology and third-party environment. You’ll provide second-line oversight across areas including information security, cyber, data and key technology partners, helping us understand where risks sit, how effectively they’re being managed and where further assurance or action may be needed.

You’ll also help Nest look ahead. From AI and emerging technology to evolving cyber threats and greater reliance on third parties, you’ll help us understand what these developments mean for the organisation and how we can respond proportionately. It’s a role for someone who enjoys getting underneath complex issues, working collaboratively with technical specialists and bringing an independent perspective that helps the organisation make well-informed decisions.

Skills we’re looking for

• Strong knowledge of information security and technology risk, with a good understanding of areas such as access control, vulnerability management, monitoring, incident response and secure development.
• Experience working with recognised technology and information security frameworks, particularly ISO 27001 and NIST, ideally within a complex or regulated organisation.
• An understanding of second-line risk, assurance or oversight, and the judgement to provide independent, constructive challenge while building strong relationships with first-line teams.
• Experience assessing and overseeing third-party technology risk, with the ability to understand the risks associated with complex technology and outsourcing relationships.
• A good understanding of data and cyber risk, and the ability to translate technical issues into clear risk insight for senior stakeholders.

It would be great if you also bring

Experience in some of the following would be useful, but we don’t expect you to have everything:

• Product security or secure software development lifecycle assurance.
• AI risk, data ethics or emerging technology governance.
• UK GDPR and the Data Protection Act 2018.
• Threat intelligence, vulnerability disclosure or security testing.
• Knowledge of the regulatory environment affecting financial services or pensions.
• Professional qualifications such as CISM, CISSP, ISO 27001 Lead Implementer/Lead Auditor or CRISC.

Flexible and agile working

Everyone's personal situation is different.

To make the most out of hybrid working, we've introduced different ways of working, which include (subject to role requirements):

• hybrid of office (Canary Wharf, London) and home working (there will be an expectation to attend the office, once - twice a week, or more, as required)

Directorate/Department Overview

The Technical Risk team sits within the Risk Directorate, along with Risk, Risk Assurance, Risk Operations and Regulatory Risk, and Controls Oversight. The directorate supports the business in delivering its strategic priorities by overseeing that risk and controls are identified, prioritised and managed through an enterprise risk management framework. Nest operates a ‘three lines of defence’ model, with Risk sitting in the second line providing advice, guidance and challenge to the first line.

The Technical Risk team sits within the Risk Directorate, along with Risk, Risk Assurance, Risk Operations and Regulatory Risk, and Controls Oversight. The directorate supports the business in delivering its strategic priorities by overseeing that risk and controls are identified, prioritised and managed through an enterprise risk management framework. Nest operates a ‘three lines of defence’ model, with Risk sitting in the second line providing advice, guidance and challenge to the first line.

The Technical Risk team provides support to Nest specifically in relation to risks covering data, privacy, technology, cyber and financial crime. Support includes conducting investigations, regulatory reporting as well as training and awareness across Nest Corporation.

Organisational Overview

Nest is an award-winning workplace pension scheme, the largest in the country.
Set up by the government to give every worker in the UK somewhere to save, our first-class responsible investment practice and governance are the backbone of what we do, supported by all the functions you’d expect to find in a thriving business. We’re committed to creating a workplace where you can be your authentic self and offer an inclusive and flexible working environment.
Diversity, Equity and Inclusion

Everyone is welcome to apply for our roles, and we are determined to ensure that no applicant or employee receives less favourable treatment because of their age , disability, gender identity, marital status, national origin, pregnancy or caring responsibilities, race, religion/belief, sex, sexual orientation or socio economic background.
We also recognise the importance of diversity of thought and other forms of neurocognitive variation.

Nest is a Disability Confident Leader, which is the highest level of the Disability Confident Scheme. If you have a disability, please declare that you’re applying through the scheme .

We aim to offer an interview to those applicants who apply through the Disability Confident Scheme and best meet the minimum criteria. However, there may be some circumstances where this is not possible due to the volume of applications.

Please note that this advert may close early if we receive a sufficient number of satisfactory applications.
If you have any difficulty in sending your application or need the application pack in an alternative format, or you require any reasonable adjustments please contact: [e-mail].