Risk Manager

Job Description

Location:Hybrid: this role could be based in either our Edinburgh, London or Birmingham offices, with time spent working weekly in both the office and  amount of time working from the office is variable based on business need.

Flexible working: All of our roles are open to part-time, job-share and other types of flexibility. We will discuss what is important to you and balancing this with business requirements during the recruitment process. You can read more about Phoenix Flex here.

Closing Date:26th February 2026

Salary and benefits:Up to £70,000, dependent upon experience, plus 16-32% bonus potential, private medical cover, 38 days annual leave, excellent pension, 12x salary life assurance, career breaks, income protection, 3x volunteering days and much more.

We want to be the best place that any of our 6,600 colleagues have ever worked.

We’re Phoenix Group, we’re a long‑term savings and retirement business. We offer a range of products across our market‑leading brands, Standard Life, Sun Life, Phoenix Life and ReAssure. Around 1 in 5 people in the UK has a pension with us. We’re a FTSE 100 organisation that is tackling key issues such as transitioning our portfolio to net zero by 2050, and we’re not done yet.

Non-Financial Risk is part of Group Risk and has a fantastic opportunity for a talented individual to join the team as an Information Security & Cyber Risk Manager within the newly forming IT/IS/Resilience and Supplier Risk Oversight Team. The role is to provide Second Line Subject Matter Expert (SME) advice, oversight and challenge on Line 1’s design and operation of their Information Security, Information Management and Cyber related standards, risks and controls.

The role holder will, in addition to regular oversight of the Information Security, Information Management and Cyber Risk control environments, both lead and support the delivery of a rolling programme of Thematic and Risk based focused reviews, following a structured methodology. This will involve shaping the scope of reviews, preparing for and performing field work, validation of proposed findings and provision of insightful recommendations to Line 1 through clear written reporting.

• Provide ongoing oversight and challenge to Line 1 led Information Security, Information Management and Cyber Risk control management
• Analyse and interpret key risk indicators and risk and control reporting to help determine where Line 2 effort is best focused, and to develop formal Line 2 opinions on Information Security, Information Management and Cyber matters
• Provide insight, oversight and challenge within assigned monthly Forums
• Lead Line 2 led Information Security, Information Management and Cyber Risk Thematic/Risk Reviews throughout the full lifecycle, including Planning/Terms of Reference, Fieldwork, Findings Validation and Reporting stages
• Provide oversight and challenge on material Projects and Programmes
• Oversee Line 1 activity to ensure adherence to the Group’s Risk Management Framework, providing advice and guidance as required
• Support the broader team with assigned Line 2 activity relating to Information Technology, AI, Operational Resilience and Third-Party Management
• Develop and build relationships with Line 1 and Line 3 peers and senior stakeholders

• Proven experience managing Information Security, Information Management and Cyber Risk, in either a second or third-line capacity, within a high regulated UK industry such as Financial Services
• Strong stakeholder, relationship management and influencing skills. An accomplished communicator who is comfortable, respectful and calm during sometimes challenging situations where differences of risk opinion need to be clearly positioned and justified. Able to analyse situations in a timely manner, producing clear, insightful and succinct written reports.
• Preferred:
  Professional qualification in Information Security, Information Management or Cyber Security e.g., from IRM, BCS, ISACA or ISC2 organisations.
• Preferred:
  Knowledge of Artificial Intelligence (AI) – naturally curious about AI and the advantages it can bring to…