Most operational resilience roles in asset management give you part of a programme. This one gives you all of it: a single role, created to own operational resilience and business continuity across the EMEA entities of a global investment manager, based in London.
Regulators across the region now expect proof rather than policy: important business services tested to their impact tolerances, continuity plans that have been exercised, third parties overseen, DORA reporting that arrives on time. The firm has concluded that this needs one accountable owner for the region, reporting to the regional risk committee and the boards of the local entities, and chairing the forum where technology risk is governed.
What you will build and own
Evidence
- A current map of the firm's important services, with impact tolerances set and defended for each, retested every year against severe but plausible scenarios.
- The resilience policy and the annual self-assessment, kept honest by what the testing actually shows.
- A view of the firm's exposure to its material third parties, built with the people who own those relationships.
Readiness
- Business impact analysis for every location and function, and continuity plans that reflect it.
- An exercise calendar the technology teams take part in, across the region and with the wider group.
- A network of continuity representatives across the business who know their part and have rehearsed it.
Response
- Incidents managed and communicated properly when they happen, with post-incident reviews that find the root cause and the deeper reviews the serious ones deserve.
- Findings converted into owned remediation actions, tracked to closure rather than filed.
Governance
- The technology risk framework overseen alongside the first-line technology risk team, with the annual DORA review of which functions count as critical or important.
- The technology risk forum chaired, with the challenge coming from you.
- DORA's incident reports and register of information fed accurately, with information security as a working partner on cyber resilience.
- Management information and key risk indicators reported to the regional risk committee and the entity boards; the firm's reference point on FCA and EU regulatory change; resilience projects that reach beyond the region.
What you bring
You will have come up through resilience, continuity, operational risk, technology risk or internal audit inside an asset, wealth or investment manager; banking or insurance experience on its own will not meet the brief. The client's stated minimum experience is lower than you might expect; we are looking at people with five years or more in the field. You will have delivered FCA PS21/3 in practice rather than reviewed someone else's delivery. You will be comfortable in front of a board, able to build relationships across a firm and to move people who do not report to you, and able to deliver a programme to a timetable. A degree in a relevant subject and the right to work in the UK are both required.
Where it takes you
Scope, first. Most people in resilience spend years owning a slice of the programme, the continuity plans, say, or the testing calendar, while someone else presents the whole. This role hands you the whole of it for a region, at VP grade, with the regional risk committee and the entity boards as your audience. That is the record a head-of appointment is built on, and you would be building it at a global manager whose name you will know.
Then the room to shape it. In the region, the resilience decisions are yours: which tolerances you are prepared to defend and how, what the exercise calendar looks like, what the committee sees and in what order, and where next year's effort goes. The region's resilience function is yours to run, from the network of representatives to the papers the boards read; you build on the framework rather than administer someone else's, and the group's resilience projects give you reach beyond EMEA when you want it.
And the work is visible. You chair the technology risk forum and present to the regional risk committee and the entity boards. The reporting that goes to the regulators goes out under your name. Senior people across the region will know your work inside a quarter, because it reaches them directly rather than through a layer above you.
Why you
The people who succeed in roles like this have delivered the work themselves inside an asset, wealth or investment manager, often as the London or EMEA lead for a firm headquartered elsewhere, and can explain a scenario test result to a COO as clearly as to a regulator.
It is sized for a strong number two, or the sole resilience owner at a smaller manager, who is ready to be the accountable name. You will run the representatives across the business, work alongside the technology teams, and answer for the outcome yourself. If you would rather delegate that accountability, the role will feel demanding; if you have been waiting for it, you will recognise it.
If the timing is right for you, and you want a bigger challenge than the one you have, apply. We are looking for someone who can deliver excellence in resilience for a region, and we will be delighted to consider your application.
RiskTAE is acting as an employment agency for this role and is an equal opportunities recruiter. Every application is assessed on the experience and capability it shows, whatever your background. If you need an adjustment at any stage of the process, tell us and we will arrange it.