Technology Risk Manager

Nest Pensions; Greater London; Hybrid; GBP 70,000 - 90,000; Full time

Benefits offered by this job

Hybrid working

Learning opportunities

Job summary

Nest Pensions is seeking a second line risk professional to provide independent oversight of technology, information security, cyber, data and third-party risk. You’ll work with specialist teams to understand decisions, challenge them constructively and help shape our risk assurance approach for Nest.

You’ll translate complex technical risks into clear insights for senior stakeholders and support ExCo, Risk Committee and the Board in decision-making.

Qualifications

• Strong knowledge of information security and technology risk, including access control, vulnerability management, monitoring, incident response and secure development.
• Experience with frameworks such as ISO 27001 and NIST in a regulated environment.
• Understanding of second-line risk, assurance or oversight and ability to provide independent challenge.
• Experience overseeing third-party technology risk and outsourcing arrangements.
• Ability to translate data and cyber risk into clear insights for senior stakeholders.

Responsibilities

• Provide second-line oversight across information security, cyber, data and technology risk.
• Ask the right questions and challenge decisions with independent perspective.
• Collaborate with first-line teams to shape risk assurance and governance.
• Assess risks from complex technology and third-party relationships and determine actions.
• Support senior stakeholders including ExCo, Risk Committee and the Board with risk insights.

Skills

InfoSec risk

Tech risk

ISO 27001

NIST

Second-line risk

Third-party risk

Data risk

Independent challenge

Job description

This is an opportunity to join Nest at an exciting point in the development of our approach to technology and data risk. As a new role within our second line Risk team, you’ll have real scope to shape how we provide independent oversight and assurance across technology, information security, cyber, data and third-party risk.

You’ll work closely with specialist teams across Nest, bringing the technical understanding and curiosity to ask the right questions, understand the decisions being made and provide thoughtful, independent challenge. Rather than simply working within an established framework, you’ll have the autonomy to help design and develop our approach, turning complex technical risks into clear insight that supports senior decision-making across ExCo, Risk Committee and the Board.

A significant part of the role will be looking at the risks that come with an increasingly complex technology and third-party environment. You’ll provide second‑line oversight across areas including information security, cyber, data and key technology partners, helping us understand where risks sit, how effectively they’re being managed and where further assurance or action may be needed.

You’ll also help Nest look ahead. From AI and emerging technology to evolving cyber threats and greater reliance on third parties, you’ll help us understand what these developments mean for the organisation and how we can respond proportionately. It’s a role for someone who enjoys getting underneath complex issues, working collaboratively with technical specialists and bringing an independent perspective that helps the organisation make well‑informed decisions.

Skills we’re looking for

• Strong knowledge of information security and technology risk, with a good understanding of areas such as access control, vulnerability management, monitoring, incident response and secure development.
• Experience working with recognised technology and information security frameworks, particularly ISO 27001 and NIST, ideally within a complex or regulated organisation.
• An understanding of second‑line risk, assurance or oversight, and the judgement to provide independent, constructive challenge while building strong relationships with first‑line teams.
• Experience assessing and overseeing third‑party technology risk, with the ability to understand the risks associated with complex technology and outsourcing relationships.
• A good understanding of data and cyber risk, and the ability to translate technical issues into clear risk insight for senior stakeholders.

Experience in some of the following would be useful, but we don’t expect you to have everything:

• Product security or secure software development lifecycle assurance.
• AI risk, data ethics or emerging technology governance.
• UK GDPR and the Data Protection Act 2018.
• Threat intelligence, vulnerability disclosure or security testing.
• Knowledge of the regulatory environment affecting financial services or pensions.
• Professional qualifications such as CISM, CISSP, ISO 27001 Lead Implementer/Lead Auditor or CRISC.

Don't worry if you think you don't have all the key skills, it might be worth taking the few minutes to apply as we're good at spotting potential. At Nest, you’ll have access to a range of learning opportunities to learn, grow and build the skills you need to be successful in your role and career.

Flexible and agile working

Everyone's personal situation is different.

To make the most out of hybrid working, we've introduced different ways of working, which include (subject to role requirements):

• hybrid of office (Canary Wharf, London) and home working (there will be an expectation to attend the office, once - twice a week, or more, as required)
• vary working hours

Directorate/Department Overview

The Technical Risk team sits within the Risk Directorate, along with Risk, Risk Assurance, Risk Operations and Regulatory Risk, and Controls Oversight. The directorate supports the business in delivering its strategic priorities by overseeing that risk and controls are identified, prioritised and managed through an enterprise risk management framework. Nest operates a ‘three lines of defence’ model, with Risk sitting in the second line providing advice, guidance and challenge to the first line.

The Technical Risk team provides support to Nest specifically in relation to risks covering data, privacy, technology, cyber and financial crime. Support includes conducting investigations, regulatory reporting as well as training and awareness across Nest Corporation.

Organisational Overview

Nest is an award‑winning workplace pension scheme, the largest in the country.

Set up by the government to give every worker in the UK somewhere to save, our first‑class responsible investment practice and governance are the backbone of what we do, supported by all the functions you’d expect to find in a thriving business. We’re committed to creating a workplace where you can be your authentic self and offer an inclusive and flexible working environment.

Diversity, Equity and Inclusion

Everyone is welcome to apply for our roles, and we are determined to ensure that no applicant or employee receives less favourable treatment because of their age, disability, gender identity, marital status, national origin, pregnancy or caring responsibilities, race, religion/belief, sex, sexual orientation or socio economic background.

We also recognise the importance of diversity of thought and other forms of neurocognitive variation.

Nest is a Disability Confident Leader, which is the highest level of the Disability Confident Scheme. If you have a disability, please declare that you’re applying through the scheme.

We aim to offer an interview to those applicants who apply through the Disability Confident Scheme and best meet the minimum criteria. However, there may be some circumstances where this is not possible due to the volume of applications.

Please note that this advert may close early if we receive a sufficient number of satisfactory applications.

If you have any difficulty in sending your application or need the application pack in an alternative format, or you require any reasonable adjustments please contact: [e-mail].