[Hiring] Manager - Risk @Foundever®

Role Description

Runs the IT operational risk discipline day to day across the Telecom, Network, Systems — the register, the assessments, the control testing and the resilience assurance that together give leadership an honest view of where the estate is exposed and what is being done about it.

• Identify and quantify operational risk before it presents as an incident — single points of failure, capacity and obsolescence, control gaps, concentration and dependency.
• Drive treatment plans to named owners and dates, and hold them there until closed or formally accepted at the right level.
• Assure resilience and recoverability through evidence — tested, documented and honestly reported — rather than through assumption.
• The role carries process ownership rather than remediation delivery. Its value lies in the accuracy of the picture it presents and the persistence with which it pursues closure.

Qualifications

• 8–10 years in IT operations, IT risk, IT audit, resilience or service management, including at least 3 years working directly on operational risk or control assurance in a multi-site enterprise.
• Hands-on ownership of a risk register — assessment, scoring, treatment tracking and review cadence — not solely reporting on one maintained elsewhere.
• Working knowledge of infrastructure and operations — network, telecom, data centre, cloud and security operations — sufficient to assess exposure credibly and challenge a technical position.
• Practical experience of DR and continuity testing, RTO/RPO validation and recovery documentation.
• Audit exposure: evidence preparation, findings response and remediation tracking against ISO 27001, SOC 2, PCI DSS or comparable frameworks.
• Comfortable extracting and interrogating incident, problem and change data from ITSM tooling (ServiceNow, Remedy or equivalent) and building the analysis in Excel.
• Clear written communication — risk statements that a non-specialist executive can act on, without dilution or alarmism.
• Bachelor's degree in Engineering, IT or a related discipline.

Requirements

• Own the day-to-day operation of the IT operational risk register: intake, assessment, scoring against the agreed impact and likelihood scale, ownership assignment, and periodic review to a fixed cadence.
• Run structured risk assessments for sites, platforms, circuits and services; document exposure, existing controls, residual risk and recommended treatment.
• Maintain the single-point-of-failure and concentration view across circuits, carriers, data centres, platforms and key suppliers, and keep it current as the estate changes.
• Mine incident, problem and change data for emerging risk signals — repeat causes, ageing infrastructure, capacity pressure and control bypass — and convert them into register entries.
• Prepare risk acceptance submissions with a clear statement of exposure and rationale, for decision at the appropriate authority level.
• Maintain the DR and business continuity test calendar; ensure tests are scheduled, executed, evidenced and reported without softening the result.
• Review backup, replication, failover and recovery capability against stated RTO and RPO commitments, and raise the gap where reality does not meet the commitment.
• Track remediation of failed or partial test outcomes through to retest and closure.
• Maintain current recovery documentation and dependency mapping for critical services and sites.
• Operate the control testing schedule across service management and infrastructure controls; document evidence, exceptions and compensating controls.
• Coordinate internal and external audit requests — evidence collection, walkthrough support and response drafting — and track findings to remediation closure.
• Maintain alignment of the control set to ITIL 4, ISO 20000, ISO 27001, SOC 2 and PCI DSS expectations as applicable to the estate.
• Assess the risk implications of significant changes and new services before they enter production, and feed the position into the change process.
• Assess and periodically reassess vendor and supplier risk — dependency, resilience posture, security position and concentration — working with the Vendor Management Office.
• Produce the risk view for the daily, weekly and monthly IT Operations reporting cycle and the Monthly Business Review: movement, ageing, overdue treatments and top exposures.
• Escalate stalled treatments and unaccepted high risks through the Senior Manager on a defined trigger, not on request.
• Brief tower owners and service leads on their open risk position, and support them in building credible treatment plans.

Benefits

• Impactful work.
• Opportunity to work on cutting-edge AI technologies that will be game-changers for our business.
• Professional growth.
• Continuous learning and development opportunities in a dynamic, remote work environment.
• Competitive compensation.
• Attractive salary and benefits package.
• Collaborative environment.
• A supportive team culture with opportunities for occasional travel for training and industry events.