Risk Officer

ROLE OVERVIEW:

The Risk Officer is a key second-line role within the organisation’s risk management function. Operating within the Three Lines of Defence model, the Risk Officer acts as a dedicated Business Partner and Subject Matter Expert (SME) across a broad set of risk categories, providing guidance, oversight, and challenge to first-line business areas to ensure risk management frameworks, policies, and practices are effectively embedded throughout the organisation. The Risk Officer provides structured oversight and constructive challenge to first-line risk owners, supporting them in identifying, assessing and mitigating risk and ensuring that risk management practices are aligned to Group policies, regulatory requirements, and internal standards. The role is responsible for developing and maintaining risk profiles, overseeing the loss event management process, facilitating Risk and Control Self-Assessments (RCSAs), and leading root cause analysis on significant risk events. Beyond day-to-day risk oversight, the Risk Officer plays an active role in promoting a strong and sustainable risk culture across the organisation – delivering training, embedding good risk management behaviours at all levels. This is a broad and impactful role that calls for a solid understanding of risk management principles and the regulatory environment, whilst providing strong analytical capability and the ability to engage credibly and influentially with stakeholders at all levels – translating complex risk matters into clear, actionable insight for both specialist and non-specialist audiences.

KEY DUTIES & RESPONSIBILITIES

• Act as a second‑line Risk Business Partner, providing advice, oversight, and constructive challenge to managers and staff across the organisation. Support the effective identification, assessment, and management of risks, including maintaining risk registers and using risk management systems and tools to embed consistent and high‑quality risk practices.
• Support first‑line teams in understanding their risk profile and risk appetite, and in designing, implementing, and monitoring effective control measures to mitigate known risks and reduce residual exposure.
• Contribute to the development and embedding of a strong risk management culture, ensuring compliance with organisational, Group, regulatory, and legislative requirements. This includes conducting regular engagement with risk owners to review risk profiles, challenge control effectiveness, and assess alignment to agreed risk appetite.
• Coordinate and support the monitoring, triage, escalation, and reporting of risk events across the business. Ensure timely assessment and escalation of incidents and emerging risks in line with established procedures and governance expectations.
• Act as a point of contact for risk reporting and risk advice to third parties, supporting effective information exchange and alignment with organisational risk frameworks.
• Lead or support Root Cause Analysis (RCA) for high‑risk events and material incidents, identifying underlying issues and control weaknesses, and ensuring remediation actions are clearly defined, tracked, and reported.
• Provide timely and insightful input to the Head of Risk on emerging and material risks, control effectiveness, and mitigation strategies. Produce regular reporting for senior management and governance forums, highlighting key themes, trends, and areas requiring attention.
• To provide support with third party risk management, including assessing, monitoring, and mitigating risks associated with external partners, ensuring alignment with organisational risk frameworks and regulatory requirements.
• Support Business Continuity Management (BCM) and broader operational resilience activities, including reviewing BCM arrangements, supporting impact assessments and scenario testing, and providing challenge to ensure continuity and resilience requirements are appropriately designed, maintained, and evidenced.
• Facilitate and conduct Risk and Control Self-Assessments (RCSA), escalating control deficiencies to management, tracking remediation progress, and maintaining accurate documentation of key controls by risk category.
• Contribute to Risk Committee and governance reporting, supporting informed decision‑making and effective oversight of the organisation’s risk profile.
• Promote understanding and effective application of the Three Lines of Defence model, supporting adherence to company and Group standards.
• Remain flexible and adaptable, responding to evolving organisational priorities, regulatory change, and additional duties as required.

SKILLS REQUIRED

• Strong understanding of risk management principles and frameworks, including the Three Lines of Defence model.
• Competent in using software-based risk management tools, databases, and reporting systems.
• Ability to work collaboratively with key internal and external stakeholders.
• Experience writing formal reports for senior audiences, conveying complex information clearly and in plain English.
• Up‑to‑date knowledge of FCA, PRA regulatory and legislative developments; proactively shares knowledge across the organisation.
• Sound decision‑maker, comfortable with tight deadlines with a particular focus on controls.
• Confident in supporting and delivering risk advice to non‑expert internal clients with competing priorities.
• Good understanding of relevant UK rules, legislation, and regulations and how these can be applied to achieve positive commercial outcomes.
• Ability to maintain a high level of mental flexibility and extract actionable insight from reports, datasets, and verbal communications.
• Understanding of industry best practice in risk management, with links to external bodies and network forums.
• Strong analytical and logical problem‑solving skills; a self‑starter who can apply knowledge and risk management practices to progress issues.

EXPERIENCE REQUIRED

• Good knowledge of operational risk management principles, with beneficial specialist knowledge in Business Continuity Management and Third‑Party Risk Management, particularly in relation to operational resilience.
• Demonstrated experience in identifying, assessing, and mitigating risks in a business context.
• Experience in developing and implementing risk management policies and procedures.
• Hands‑on experience in conducting risk assessments and evaluating the potential impact of various risks.

#J-18808-Ljbffr