Head of Risk & Resilience

Location:

London, UK or Tallinn, Estonia | Hybrid

Reports to:

Group Chief Compliance & Risk Officer / MLROFunction:
Second line risk, independent of the Fin Crime/AML line (Deputy MLRO)
Type:
Permanent, full-time About Pockit and Monese Pockit and Monese are all-in-one money apps that make it easier for people to access and manage the financial tools they need to take control of their money.

We provide vital financial services, from accounts and cards to income advance solutions. In October 2024, Pockit acquired Monese, bringing together two complementary businesses and creating a leading fintech company focused on serving people who are underserved by traditional banks.

Together, we serve more than three million customers across the UK and Europe.

We're a diverse, international and energetic team, with colleagues based across London, Newcastle, Tallinn and remote teams across Central Europe. We value curiosity, ambition, accountability and resilience, and we want everyone to feel at home, have a voice and know that their contribution matters. We give people the trust and space to take ownership, share ideas, influence decisions, and make a real impact on our customers and our business.

Role Purpose We are looking for a hands-on Head of Risk & Operational Resilience to own, build, and run our operational and prudential risk capabilities across  this role, you will be the accountable owner for our operational resilience framework- specifically focusing on wind-down planning, business continuity, incident management, and third-party/outsourcing risk management in accordance with FCA expectations and DORA standards.

This is a build-and-run, individual contributor role initially. You will close current resourcing gaps across all three areas and build the underlying risk management toolkit (KRIs, control self-assessment, risk event log) needed to run them sustainably.

What you'll do1. Risk Framework & Audit Interface Own the Risk & Control Self-Assessment process and a KRI framework across all operational areas.

Maintain an operational risk event log with clear escalation, investigation, and remediation tracking.

Act as primary liaison for internal and external audit on wind-down, incident management, and TPRM matters; align control design with audit recommendations
2. Third-Party & Outsourcing Risk Management Regulatory basis: DORA Art. 28–44; EBA/GL/2019/02; FCA SYSC 8;
Operational Resilience (PS21/3), including mapping of third parties supporting important business services

Own the Third Party Risk Management framework, running rigorous risk assessments, ensuring due diligence is performed, maintaining the DORA Register of Information, and guaranteeing that robust exit strategies are in place for critical vendors.

Ensure TPRM aligns with BCP maintaining the mapping of critical third parties against important business services
3. Operational Risk Management & Wind-Down Planning Regulatory basis:
Electronic Money Regulations 2011; EBA/GL/2021/11

Map out critical business services and be the primary author of the firm's board- and FCA-approved Wind-Down Plan (WDP) and Business Continuity Plans (BCP), ensuring the firm can weather operational crises without harming consumers

Design and run the WDP and BCP testing programme - scenario testing, timeline/resource feasibility checks, and business impact analysis - evidencing the plan works operationally, not just that it exists

Benchmark against the FCA's 2025 multi-firm WDP review and the shift in supervisory tone (e.g. PS25/12) from document-existence to demonstrated execution capability

Governance & Reporting:

Feeds risk MI into the Risk Committee and Board reporting owned by the CCRO/MLROCollaborate with the Deputy MLRO on third-party or incident matters with a financial-crime dimension, without owning fincrime risk itself.

What you'll bring

Track record building or running a second-line operational/prudential risk function in a UK-regulated payments, e-money, or banking firm.

Direct experience with wind-down/recovery planning under EMR 2011/PSR 2017 or equivalent prudential regimes.

Hands-on incident management and resilience testing experience - able to design and run simulation exercises, not just write policy.

Practical DORA implementation experience (Art. 17–23 incident reporting; Art. 28–44 third-party risk), given Monese's EU entity exposure.

Outsourcing/TPRM experience including fourth-party due diligence

Experience running KRI/CSA frameworks and acting as an audit liaison

Comfortable…