Head of Risk & Resilience

Overview

In this role you will own and run the operational and prudential risk capabilities for Monese, focusing on wind-down planning, business continuity, incident management, and third-party risk. You will build the risk toolkit (KRIs, CSA, risk event log) and close resourcing gaps as an initial contributor. You’ll interface with audit and boards, ensuring alignment with FCA expectations and DORA standards. This is a build-and-run position with impact across regulatory risk, operations, and outsourcing management.

Pay / Benefits

• 25 days annual leave
• private medical with Confido
• pension plan
• hybrid working
• L&D budget + 10 learning days
• annual eye care allowance

Responsibilities

• Own the Risk & Control Self-Assessment process and KRI framework across operational areas
• Maintain operational risk event log with escalation, investigation, and remediation
• Act as liaison for internal/external audit on wind-down, incident management, and TPRM matters
• Own Third Party Risk Management framework with due diligence and exit strategies for critical vendors
• Map critical services for wind-down/plans and lead BCP/WDP governance and testing programs
• Coordinate risk MI to Risk Committee and Board; collaborate with Deputy MLRO on fincrime matters
• Lead design and testing of wind-down, BCP scenarios, and business impact analyses
• Benchmark against FCA multi-firm WDP reviews and evolving supervisory expectations

Key requirements

• Second-line operational/prudential risk leadership in UK-regulated payments, e-money, or banking
• Wind-down/recovery planning experience under EMR 2011/PSR 2017 or equivalent
• Hands-on incident management and resilience testing experience
• Practical DORA implementation experience (Art. 17–23, 28–44)
• Outsourcing/TPRM experience including due diligence across fourth parties
• Experience running KRI/CSA frameworks and serving as audit liaison
• Comfort with starting a build-out with limited resources

• collaboration
• curiosity
• ownership
• DORA Art. 17–23 incident reporting
• DORA Art. 28–44 third-party risk
• EMR 2011/PSR 2017 or equivalent prudential regimes

…