Technology Risk & Resilience Manager (Second Line) in London

MUFG Investor Services is a trusted partner to many of the world’s largest public and private funds, providing asset servicing and operational solutions built for alternatives. With over $1 trillion in client assets under administration, we offer fund administration, banking, payments, fund financing, foreign exchange overlay, corporate and regulatory services, custody, business consulting, and more. Operating from 17 locations worldwide, we help clients mitigate risk, enhance efficiency, and navigate the operational complexities of today’s investment management landscape.

We are looking for an experienced Technology Risk & Resilience Manager to join our second line risk in London, United Kingdom or Dublin, Ireland. In this pivotal role, you will:

• Second Line Oversight & Framework Integration: Provide independent second line oversight and credible challenge of Technology Risk (Information Technology and Information Security) within the firm, ensuring effective integration of technology risk into the overarching second line Risk Management Framework, including alignment with DORA, third-party risk, and service resilience expectations.
• Define and embed Technology Risk (IT & Information Security) appropriately within the Operational Risk Taxonomy and Framework, ensuring clear, documented delineation of 1LOD vs 2LOD accountability in line with company’s governance models.
• Provide independent 2LOD oversight of the Technology Risk Management Framework, assessing its alignment and interdependency with first-line control frameworks (e.g. Third-Party Risk Management, IT Controls, Cybersecurity, etc.) and ensuring coherence with second line Operational Risk and Resilience frameworks.
• Support the maturation of a consistent service-based view of technology risk by challenging 1LOD mapping of applications, infrastructure and third-party ICT services to internal and client-facing business services.
• Review and challenge first line identification and assessment of technology risks, including application risk, infrastructure dependencies, information security risks and third-party technology dependencies, ensuring consistency with the company’s risk taxonomy and regulatory expectations.
• Assess the quality, completeness, and consistency of Technology Risk Registers, control inventories, incident remediation activities and impact analysis.
• Provide credible 2LOD challenge where risk assessments, severity ratings, or residual risk conclusions are not sufficiently supported.

• Operational Resilience: Support integration of technology risk into the firm’s Operational Risk & Resilience frameworks, including regulatory/jurisdictional aligned frameworks.
• Provide second line review and challenge of technology related incidents, including severity, client impact, and regulatory reporting considerations.
• Contribute and support with resilience testing and scenario analysis from a technology dependency perspective.

• Third Party & Technology Dependency Risk: Provide 2LOD oversight of technology-related third-party risks, ensuring appropriate risk identification where services rely on externally procured applications or infrastructure.
• Review dependency and concentration risk associated with critical technology vendors.
• Conduct thematic reviews of incidents, audit findings, or control weaknesses, and assess whether these indicate systemic risk or control gaps.

• Governance & Reporting: Draft and peer review committee papers and support where required the delivery of periodic reporting to management and governance forums.
• Deliver on annual requirement to report and present the second line technology framework as well as contribute risk reporting on technology risk themes for senior management and risk committees.
• Translate technical risk information into clear, business-relevant risk insights for non-technical stakeholders.

• Stakeholder Engagement & Collaboration: Partner with senior first line leaders and control functions to embed risk and resilience principles in business planning and oversee and support the development of technology risk reporting.

Education Requirements: Post-secondary degree in technology, business or a related discipline plus qualification in CRISC, CISSP, CISM. Fluency with frameworks such as NIST CSF, ISO 27001 / 27002, COBIT to facilitate an oversight role. Professional qualification in risk or a related discipline would be preferred but not essential.

Work Experience: 10+ years’ experience operating in a second line or independent risk oversight role overseeing Technology Risk, IT Risk, Cyber Risk in a financial institution or compatible industry. Strong knowledge of technology risk concepts, information security risk, third-party technology risk, operational resilience principles, and corporate insurance.

Functional/Technical Skills and Knowledge Requirements: Experience with DORA, operational resilience, or similar regulatory regimes. Proactive, solution-oriented mindset with the ability to work effectively in a fast-paced environment. Advanced proficiency in Microsoft Excel and experience of onboarding new systems / technology are preferred.

Take a look at our careers site and you’ll find everything you’d expect from a career with the fastest-growing business at one of the world’s largest financial groups. Now take another look. Because it’s how we defy expectations that really defines us. You’ll feel that difference in all kinds of ways. Our vibrant CULTURE. Connected team. Love of innovation, laser client focus, and next-level LEARNING & DEVELOPMENT. Oh, and we really walk the talk when it comes to HYBRID WORKING.

So, why settle for the ordinary? Apply now for a Brilliantly Different career.

We thank all candidates for applying; however, only those proceeding to the interview stage will be contacted.