Operations Risk

Who We Are

Possiede le competenze e l'esperienza giuste per questo ruolo? Continui a leggere per scoprirlo e invii la sua candidatura.

We are looking for an experiencedOperational Risk & Security Audit Manager to assume combined responsibility for programme-level operational risk management and security audit activities within a large-scale, complex IT services environment.

The role requires strong experience in enterprise risk management, information security, audit and compliance, together with the ability to coordinate effectively across multiple delivery teams, contractors and senior stakeholders.

What You'll Be Doing

• Maintain and continuously develop the overall Programme Risk Register, covering strategic, operational, financial, contractual, security and delivery risks, while ensuring appropriate integration with security risk management activities.
• Identify, assess and coordinate programme-level risks in collaboration with workstream leads, business owners, delivery teams and other relevant stakeholders.
• Perform qualitative and quantitative risk assessments, including likelihood and impact analysis, residual risk evaluation and ongoing monitoring of agreed mitigation measures.
• Develop formal risk communications, mitigation plans and escalation materials for senior management and relevant programme governance bodies.
• Ensure identified risks, dependencies and mitigation measures are appropriately reflected in project plans, statements of work and strategic planning activities.
• Monitor the overall programme risk profile and maintain risk dashboards, KPIs and management reporting, providing clear visibility of key risks, trends, mitigation progress and areas requiring management attention.
• Maintain operational risk information required for security, operational and management dashboards and contribute risk-related analysis to periodic strategic, operational and financial programme reporting.
• Facilitate risk workshops, periodic risk reviews and executive-level risk reporting, ensuring appropriate ownership, follow-up and escalation of identified risks.
• Coordinate risk management activities across multiple workstreams, delivery organisations and third-party contractors, promoting a consistent approach to risk identification, assessment and treatment.
• Work with internal and external delivery partners to align risk assessment methodologies, proposed mitigation actions and residual risk acceptance.
• Ensure appropriate traceability of risks, decisions, mitigation activities, approvals and lessons learned within the programme's knowledge management environment.
• Contribute to continuous service improvement by incorporating lessons learned from risk events, incidents, audit findings and completed mitigation activities.
• Align programme risk management activities with recognised information security and risk management standards and frameworks, including ISO 27001, while considering applicable European cybersecurity and operational resilience requirements, including NIS2, CRA and DORA.
• Plan, coordinate, execute and report on periodic internal security audits covering relevant security controls, processes, systems and supporting evidence.
• Conduct security and compliance assessments across areas including security controls, risk treatment plans, vulnerability and patch management, incident handling, access control and supply-chain security.
• Identify non-conformities, control weaknesses and improvement opportunities, prepare formal audit findings and recommendations, and monitor remediation through agreed corrective action plans.
• Support external audits and regulatory or customer inspections, including the preparation, review and coordination of required evidence packages.
• Represent the service provider during relevant audit, compliance and inspection activities and coordinate responses with internal stakeholders and delivery partners.
• Maintain the audit universe, audit calendar, audit evidence, findings and associated documentation, ensuring appropriate governance, traceability and record keeping.
• Ensure appropriate audit independence and objectivity, remaining organisationally independent from the activities and teams being audited.
• Contribute to periodic security programme, risk, compliance and management reporting, providing clear visibility of audit findings, remediation status and recurring control issues.
• Support continuous improvement of the Information Security Management System (ISMS) based on audit findings, risk assessments, incidents and lessons learned.
• Drive continuous improvement and, where appropriate, automation of risk and audit processes, dashboards, KPIs, evidence management and management reporting.
• Act as backup for the Security Risk Management function when required and support