Hybrid60-40 hybrid working applies after successful probation.
Risk & ComplianceRegulatory Compliance & Ethics
About the job
Requirements
At least 4 years of experience managing business continuity, information technology disaster recovery, or operational resilience.
Experience in the financial services sector, preferably in a bank or regulated entity.
Knowledge and understanding of Prudential Regulation Authority, Financial Conduct Authority, and Bank of England operational resilience regulations, including SS1/21 and PS6/21.
Strong knowledge and experience in business continuity planning, disaster recovery, incident management, and crisis response.
Strong risk management knowledge and experience conducting risk assessments, setting impact tolerances, performing scenario testing, and developing resilience metrics.
A degree in information technology or cybersecurity, or equivalent relevant and specialized skills and certification in business continuity, information technology disaster recovery, or operational resilience.
Responsibilities
Stay ahead of regulatory expectations and evolving resilience standards.
Develop, test, and refine the operational resilience framework, policies, procedures, and test plans.
Identify and define Important Business Services in collaboration with business and technology teams.
Assess, review, and set impact tolerances for each Important Business Service in alignment with business and regulatory requirements.
Prepare and submit reports on operational resilience, control effectiveness, plans, implementation, and testing to stakeholders and senior management.
Coordinate internal and external operational resilience audits, provide evidence packs, and track findings and actions through closure.
Test and validate impact tolerances, produce test evidence and results analysis, and develop remediation plans for breaches.
Develop, test, and refine Business Continuity Management, Incident and Crisis Management, and Incident Response Plans.
Coordinate operational resilience testing exercises, including scenario testing, stress testing, and crisis simulations.
Monitor regulatory developments and translate emerging requirements into updates to the operational resilience framework, policies, and procedures.
Monitor and report on operational incidents, maintain a lessons-learned register, and track remediation actions through closure.
Assess and oversee the operational resilience of third-party service providers, including cloud and payment service providers.
Act as the primary liaison with information technology for disaster recovery planning, testing, and execution.
Work with information technology and cybersecurity teams to align technology resilience and cyber threat mitigation strategies with operational resilience objectives.
Assess and document the resilience impact of cloud adoption and payment scheme changes, including CHAPS, FPS, and SWIFT, and produce resilience impact assessments for sign-off.
Collaborate with stakeholders across risk, compliance, operations, information technology, and business functions to embed resilience principles.
Develop and deliver operational resilience awareness training and communications to staff, stakeholders, and senior management.
Maintain the Important Business Services register and impact tolerance workbook.
Maintain scenario and impact tolerance test reports, including results analysis and remediation plans for breaches.
Maintain, test, and refresh Business Continuity Management, Crisis Management, and Incident Response plans on an agreed cycle.
Maintain third-party resilience assessments for cloud and payment service providers.
Prepare operational resilience management information packs for OPCO and other committees as requested.
Maintain audit evidence packs and action trackers through closure.
Maintain the incident lessons-learned register and remediation tracker.
Maintain training completion records evidencing resilience awareness.
Desired Qualifications
Technology-centric training and certification is an advantage.
We're looking for a skilled and proactive specialist in Operational Resilience to join our team and play a critical role in strengthening the bank's ability to withstand and recover from disruptions. This position is central to ensuring our compliance with the stringent operational resilience requirements set by the Bank of England, Financial Conduct Authority (FCA), and Prudential Regulation Authority (PRA).
You'll be instrumental in developing, implementing, and continually refining our operational resilience framework. Working closely with various business units, operations, and technology teams, you'll enhance our resilience posture, empowering the bank to effectively prevent, respond to, recover from, and learn from any operational disruption.
What You'll Do:
Stay ahead of regulatory expectations and evolving resilience standards.
Develop, test and refine Operational Resilience Framework, policies, procedures and test plans.
Identify and define Important Business Services (IBS) in collaboration with business and technology teams.
Assess, review and set impact tolerances for each IBS, ensuring they align with business and regulatory requirements. • Prepare and submit reports on operational resilience, control effectiveness, plans, implementation and testing to stakeholders and senior management.
Own the coordination of internal and external audits on operational resilience, providing evidence packs and tracking findings and actions through to closure.
Regularly test and validate impact tolerances to assess the bank’s ability to recover within defined limits, producing test evidence, results analysis and remediation plans for any breaches.
Develop, test and refine Business Continuity Management, Incident and Crisis Management and Incident Response Plans.
Coordinate operational resilience testing exercises, including scenario testing, stress testing, and crisis simulations.
Monitor regulatory developments and evolving resilience standards and translate emerging requirements into updates to the Operational Resilience Framework, policies and procedures.
Monitor and report on operational incidents, maintaining a lessons-learned register and tracking remediation actions through to closure.
Assess and oversee the operational resilience of third-party service providers, including cloud and payment service providers.
Act as the primary liaison with IT for disaster recovery planning, testing and execution, and work with IT and cyber security teams to ensure technology resilience and cyber threat mitigation strategies are aligned with operational resilience objectives.
Assess and document the resilience impact of cloud adoption and payment scheme changes (e.g. CHAPS, FPS, SWIFT, etc.), producing resilience impact assessments for sign-off.
Collaborate with key stakeholders across risk, compliance, operations, IT and business functions to embed resilience principles.
Develop and deliver operational resilience awareness training and communications to staff, stakeholders and senior management.
Key Deliverables
The job holder owns and maintains the following as evidence of control effectiveness:
IBS register and impact tolerance workbook, version-controlled and kept current.
Scenario and impact tolerance test reports, including results analysis and remediation plans for any breaches.
BCM, Crisis Management and Incident Response plans, tested and refreshed on an agreed cycle.
Third-party resilience assessments for cloud and payment service providers.
Operational resilience MI packs for OPCO and other committees as requested.
Audit evidence packs and action trackers, maintained through to closure.
Incident lessons-learned register and remediation tracker.
Training completion records evidencing resilience awareness across staff, stakeholders and senior management.
4+ years of experience in managing business continuity, IT disaster recovery or operational resilience.
Experience within financial services sector, preferably in a bank or regulated entity.
Knowledge and understanding of PRA, FCA and Bank of England regulations on operational resilience, including SS1/21 and PS6/21.
Strong knowledge and experience in BCP, disaster recovery, incident management, and crisis response.
Strong risk management knowledge and experience in conducting risk assessments, impact tolerances, scenario testing and developing resilience metrics.
Degree in IT, Cybersecurity or equivalent and/or relevant and specialized skills and certification in business continuity, IT disaster recovery, operational resilience. Technology-centric training and certification is an advantage.
25 days annual leave entitlement plus 8 bank holidays
Pension scheme, 4% employer contribution
Private Medical Insurance
60-40 Hybrid working after successful probation period