Senior Technology Risk and Compliance Analyst

Final date to receive applications: 2 November 2026

Department: People, Finance and Technology

Employment Type: Permanent

Location: Manchester - Carrington Training Complex & Old Trafford

At Manchester United, we believe that excellence on the pitch starts with excellence off the pitch. Our team thrives in a high-performance environment, united by a shared passion for success. We aim to elevate the standard of performance through collaboration and continuous growth, creating a space where everyone can contribute their best to our common goals.

We work together at our iconic Manchester United offices, enabling connection and innovation as we look ahead to what we can achieve as a global football club. We are excited to bring in passionate people who share our vision and drive for success.

The Senior Technology Risk and Compliance Analyst plays a key role in administering the Clubs IT risk and compliance programme, providing hands‑on support across IT controls, supplier cyber risk and wider cyber risk management activities.

The role is responsible for coordinating IT SOX compliance, PCI DSS, UK GDPR requirements, third‑party assurance and technology change risk processes, including risk assessments, control testing, due diligence reviews, remediation tracking and reporting.

As a senior individual contributor, the postholder will work closely with control owners and stakeholders to review evidence, assess risks, identify control gaps and drive corrective actions to completion, while ensuring accountability for control operation remains with the business.

The role is broadly focused on IT SOX and IT General Controls (40%), supplier cyber risk management (30%) and wider cyber risk support activities (30%), helping to strengthen the organisation’s overall risk and control environment.

• Maintain and develop Manchester United’s IT risk and compliance framework, including IT risk registers, policies, standards, assurance plans and governance reporting.
• Support compliance with IT SOX, PCI DSS, UK GDPR and internal policy requirements by defining controls, coordinating testing, reviewing evidence and tracking remediation activities.
• Conduct risk and compliance assessments for technology projects, system implementations and significant technology changes, ensuring risks are identified, assessed and managed appropriately.
• Lead technology and cyber due diligence activities for suppliers, procurements, contract renewals and service changes, assessing security, privacy, resilience and contractual risks and monitoring remediation actions.
• Identify, assess and monitor technology and cyber risks, maintaining risk registers, supporting governance forums and escalating material risks and control issues where required.
• Coordinate and evaluate IT General Controls (ITGCs), including access management, change management, vulnerability management, backup and recovery, data protection and incident management controls.
• Support internal and external audits, maintain control documentation and contribute to the continuous improvement of risk, control and assurance processes.
• Support operational resilience activities, including disaster recovery, business continuity, resilience testing and the tracking of actions arising from incidents, audits and assurance reviews.
• Prepare management information, dashboards and reporting on risk, compliance and control performance, building effective relationships with stakeholders, auditors, assessors and suppliers.

• Demonstratable experience in IT controls, IT audit, technology risk, cyber GRC, information security assurance or a related area.
• Practical experience of IT general controls,…