Technology Risk & Controls Manager

Jobtailor; Milton Keynes; On-site; GBP 70,000 - 120,000; Full time

Job summary

Jobtailor in Milton Keynes is seeking a senior risk professional to embed the Risk Management Framework across Technology and to oversee controls and vendor risk management. The role includes contributing to technology and data controls, coordinating the RCSA, and supporting ICAAP.

You will test controls and facilitate risk reporting and scenario analysis. The ideal candidate has extensive operational risk experience (10-12 years), strong communication skills, and a hands-on approach to meeting

Qualifications

• Strong risk knowledge including RCSAs, controls and risk libraries, risk event reporting.
• Expertise in technology control frameworks and vendor management standards.
• Knowledge of ISO27001 and SOC2 type controls is advantageous.
• Knowledge of non-financial risk regulatory requirements (e.g., Operational Resilience, Outsourcing).
• Hands-on assurance/monitoring of risks and controls across non-financial risk disciplines.
• Ability to be hands-on, adaptable to fast-paced controls workflows and deadlines.
• Strong written and presentation skills across seniority levels.
• Proven experience developing and overseeing vendor risk management frameworks including 3rd party risk assessment and ongoing monitoring.

Responsibilities

• Embed the Risk Management Framework across Technology, ensuring controls are documented and embedded.
• Provide input into the technology control framework and data management across Technology.
• Support Vendor Management to embed controls and meet regulatory requirements.
• Test existing and new key controls as scheduled and inform risk actions.
• Support operational resilience, technology resilience, and scenario testing.
• Coordinate and administer the bank's RCSA and refresh process.
• Assist capital calculation for Operational Risk as part of ICAAP and conduct scenario analysis.
• Update risk information in risk systems and ensure events and issues are raised.
• Prepare quantitative and qualitative input for First Line Risk Reporting and conduct deep-dive reviews.

Skills

Operational risk management

RCSA administration

ICAAP compliance

Vendor risk management

ISO27001 / SOC2

Regulatory requirements

Controls and risk libraries

Data management controls

Strong communication

Team collaboration & stakeholder mgmt

10-12 years experience

Job description

Responsibilities

• Partner with the Technology business area to embed the Risk Management Framework, including policies and procedures
• Provide expert input into the design and operation of the technology control framework, including data management, working with stakeholders across Technology to ensure that controls are documented and embedded
• Provide expert input into the vendor management framework, supporting the Vendor Management Team to develop and embed controls to ensure effective management of vendors in line with regulatory requirements
• Testing of existing and new key controls in line with agreed schedule, informing the non-financial risk profile and required management actions
• Support the operational resilience programme, with a focus on technology resilience, feeding into scenario planning and testing
• Support the coordination and facilitation of the bank’s Risk and Control Self-Assessment (RCSA) and administration of the bank’s annual RCSA refresh
• Support the capital calculation for Operational Risk as part of the ICAAP, including scenario analysis
• Hands on support in the update of risk information on the bank’s Risk systems, including ensuring risk events and issues are appropriately raised and managed
• Assembling informed quantitative and qualitative input into First Line Risk Reporting at relevant committees and conducting deep dive reviews into areas of thematic risk

Requirements

• Strong Risk knowledge and experience including RCSAs, Controls and Risk Libraries, risk event reporting
• Expertise in technology control frameworks and vendor management standards
• Knowledge of ISO27001 and SOC2 type controls would be advantageous
• Knowledge of relevant non-financial risk regulatory requirements, e.g. on Operational Resilience, Outsourcing is desirable
• Hands on experience of assurance/monitoring of risks and controls across non-financial risk disciplines
• Willing to be very hands-on and ability to adapt quickly to the workflow in support of the Controls team, with focus on delivering results and meeting deadlines
• Strong written and presentation skills, supported by experience of communication across different levels of seniority
• Ability to provide necessary challenge in a constructive manner
• Strong team player, with focus on ongoing development to support meeting objective of the team
• Overall, 10-12 years of experience in operational risk management, RCSA administration and ICAAP compliance with deep expertise in internal controls
• Proven experience in developing and overseeing vendor risk management frameworks including 3rd party risk assessment, ongoing monitoring and compliance