Technology and Data Risk Manager

This is an opportunity to join Nest at an exciting point in the development of our approach to technology and data risk. As a new role within our second line Risk team, you’ll have real scope to shape how we provide independent oversight and assurance across technology, information security, cyber, data and third-party risk.

You’ll work closely with specialist teams across Nest, bringing the technical understanding and curiosity to ask the right questions, understand the decisions being made and provide thoughtful, independent challenge. Rather than simply working within an established framework, you’ll have the autonomy to help design and develop our approach, turning complex technical risks into clear insight that supports senior decision-making across ExCo, Risk Committee and the Board.

A significant part of the role will be looking at the risks that come with an increasingly complex technology and third-party environment. You’ll provide second-line oversight across areas including information security, cyber, data and key technology partners, helping us understand where risks sit, how effectively they’re being managed and where further assurance or action may be needed.

You’ll also help Nest look ahead. From AI and emerging technology to evolving cyber threats and greater reliance on third parties, you’ll help us understand what these developments mean for the organisation and how we can respond proportionately. It’s a role for someone who enjoys getting underneath complex issues, working collaboratively with technical specialists and bringing an independent perspective that helps the organisation make well-informed decisions.

Skills we’re looking for

• Strong knowledge of information security and technology risk, with a good understanding of areas such as access control, vulnerability management, monitoring, incident response and secure development.
• Experience working with recognised technology and information security frameworks, particularly ISO 27001 and NIST, ideally within a complex or regulated organisation.
• An understanding of second-line risk, assurance or oversight, and the judgement to provide independent, constructive challenge while building strong relationships with first-line teams.
• Experience assessing and overseeing third-party technology risk, with the ability to understand the risks associated with complex technology and outsourcing relationships.
• A good understanding of data and cyber risk, and the ability to translate technical issues into clear risk insight for senior stakeholders.

It would be great if you also bring

Experience in some of the following would be useful, but we don’t expect you to have everything:

• Product security or secure software development lifecycle assurance.
• AI risk, data ethics or emerging technology governance.
• UK GDPR and the Data Protection Act 2018.
• Threat intelligence, vulnerability disclosure or security testing.
• Knowledge of the regulatory environment affecting financial services or pensions.
• Professional qualifications such as CISM, CISSP, ISO 27001 Lead Implementer/Lead Auditor or CRISC.

The Technical Risk team sits within the Risk Directorate, along with Risk, Risk Assurance, Risk Operations and Regulatory Risk, and Controls Oversight. The directorate supports the business in delivering its strategic priorities by overseeing that risk and controls are identified, prioritised and managed through an enterprise risk management framework. Nest operates a ‘three lines of defence’ model, with Risk sitting in the second line providing advice, guidance and challenge to the first line.