GRC Analyst

Our Operational Risk and Resilience function is seeking a GRC Analyst to lead the ongoing development, configuration, and support of our Archer Governance, Risk, and Compliance (GRC) platform. This is a newly created role, reflecting the growing strategic importance of Archer as the bank's central system of record for operational risk and resilience data — including Risk and Control Self-Assessments (RCSA), issue and action tracking, operational risk event logging and reporting, Business Impact Analysis (BIA), Business Continuity Plans (BCP), and Incident Management.

You will act as the bridge between business requirements and technical delivery, working closely with risk, resilience, and technology stakeholders to ensure Archer evolves to meet regulatory expectations (including PRA/FCA operational resilience requirements) and the bank's internal risk management framework. You will also play a key role in training end users, building dashboards, and producing management information (MI) and reporting for senior stakeholders including the Executive Risk Committee and the Chief Risk Officer (CRO).

This is an excellent opportunity for someone with a blend of financial services risk knowledge and hands-on GRC systems experience to shape a platform that is central to the bank's risk and resilience agenda.

Essential Qualifications and Experience

• Experience working within financial services, ideally within a retail bank or similarly regulated environment. 

• Demonstrable experience in operational risk management, including familiarity with RCSA, risk event/loss data, issue and action management, and/or operational resilience concepts (e.g., important business services, impact tolerances, BIA, BCP). 

• Hands-on experience configuring, administering, or supporting an enterprise GRC platform (e.g., Archer, ServiceNow GRC, MetricStream, Diligent/Galvanize, SAI360, or similar), including deployment/rollout of modules across an organisation. 

• Exposure to Business Intelligence/reporting tools (e.g., Power BI, Tableau) for dashboard creation.

• Understanding of the UK/European regulatory landscape relevant to operational risk and resilience (e.g., PRA/FCA rules on operational resilience, SYSC requirements, DORA). 

• Experience gathering business requirements and translating them into system design and configuration.

Skills and Competencies

• Strong analytical skills with the ability to interpret complex risk data and present it clearly to senior stakeholders.  
• Excellent communication and stakeholder management skills, with the ability to train and support users at all levels, including senior executives. 
• Detail-oriented with a strong focus on data quality, governance, and control. 
• Project management skills, with the ability to manage multiple system change requests and priorities concurrently. 
• Proactive, self-starting approach with a continuous improvement mindset. 
• Ability to work collaboratively across the three lines of defence and with technology partners.

Additional Information:

The Company is committed to diversity and equality of opportunity for all and is opposed to any form of less favourable treatment or harassment on the grounds of race, religion or belief, sex, marriage and civil partnership, pregnancy and maternity, age, sexual orientation, gender reassignment or disability.

This position is based in Dunton, and it is expected the successful candidate will be able to attend the Dunton office for typically 4 days a week and remain flexible on the days they are required to attend the office according to business requirements.

As part of our pre-employment checks process, successful candidates will be required to undergo a criminal record check. This will be conducted in line with the Rehabilitation of Offenders Act 1974 and applied only to unspent convictions.

#LI-EH1 #FordCredit 

Reporting into the Operational Risk & Resilience Manager, the role will have the following key responsibilities:

System Development & Configuration

• Gather, document, and translate business requirements from risk, resilience, and control owners into functional and technical specifications for the Archer platform.
• Configure and maintain Archer modules/applications covering RCSA, Issue & Action Management, Operational Risk Event/Loss reporting, BIA, BCP, and Incident Management.
• Manage the end-to-end change lifecycle for Archer enhancements, including requirements gathering, design, build, testing (UAT), release, and post-implementation review.
• Maintain data integrity, workflows, taxonomies, and reference data (e.g., risk categories, business services, control libraries) within Archer in line with the bank's risk taxonomy and governance standards.
• Liaise with IT/Archer technical support (internal or third-party vendor) on system upgrades, patches, integrations, and issue resolution.

Reporting & Dashboards

• Design, build, and maintain dashboards, reports, and MI packs within Archer (and associated BI tools, e.g. Power BI, if applicable) to support risk oversight and decision-making.
• Produce regular and ad hoc reporting for the Skills Teams, the Executive Risk Committee, the CRO, and the Operational Risk Manager, ensuring accuracy, timeliness, and clear articulation of risk themes and trends.
• Support the production of Board and committee-level reporting on operational risk, resilience, and incident management, including impact tolerance breach reporting where relevant.
• Continuously improve reporting outputs based on stakeholder feedback and evolving regulatory expectations.

Training & User Support

• Design and deliver training materials, user guides, and workshops to onboard new users and upskill existing users across the three lines of defence.
• Act as first point of contact for end-user queries, troubleshooting, and system support, escalating complex issues to vendor/IT support as needed.
• Promote consistent, high-quality use of Archer across the business, driving adoption and data quality improvements.

Governance & Continuous Improvement

• Support the Operational Risk Manager in aligning Archer functionality with regulatory requirements (e.g., PRA SS1/21 and FCA operational resilience rules, Basel operational risk standards).
• Identify opportunities to automate manual processes and improve efficiency of risk and resilience workflows within the system.
• Maintain a roadmap of system enhancements, prioritising based on regulatory, business, and stakeholder needs.
• Support internal and external audits, and regulatory reviews, by ensuring Archer data and processes are well-documented and evidenced.