Information Risk & Business Resilience Manager

About the role

This position provides independent second‑line oversight, advisory, challenge and monitoring across the intersecting risk domains of Information Risk, Data Privacy, Business Resilience, Technology Risk and Cyber Risk. Reporting to the Head of Non‑Financial Risk, the manager translates complex risk themes into actionable insights for senior governance committees.

Key responsibilities

• Localise Group risk frameworks and standards, embedding risk appetite across the country operation.
• Facilitate risk assessments, scenario analysis and coordinate assurance and remediation activities.
• Produce integrated risk commentary, issue escalation notes and executive summaries for management and governance bodies.
• Challenge and monitor business and technology risk owners to ensure risks are identified, assessed, treated, reported and escalated within appetite.
• Maintain robust protection of client data, information assets, technology infrastructure and critical services.

Required profile

• 7‑8 years of experience in a second‑line non‑financial risk function.
• Demonstrated expertise in at least three of the following: Information Risk, Data Privacy, Business Resilience, Technology Risk, Cyber Risk, Operational Risk, IT Audit or Business Continuity.
• Ability to interpret Group standards and regulatory expectations and translate them into practical local actions.
• Strong governance writing capability and analytical attention to detail.
• Proven ability to influence senior stakeholders while maintaining independence and professional scepticism.

Required skills

• Experience working with risk dashboards, registers, incident data, audit findings and action trackers.
• Knowledge of relevant certifications such as CISA, CISM, CRISC, CISSP, ITIL, ISO 22301, ISO 27001 or equivalent.