Enterprise, Third-Party & Resilience Risk Manager

About the role

HT is looking for an Enterprise, Third-Party and Resilience Risk Manager who will protect the company's exposure to partners, OEMs and suppliers, and ensure business continuity and crisis readiness. The role covers contract review, third-party lifecycle management, business continuity (ISO 22301), crisis management and risk reporting, working closely with Legal, Finance, Partnerships, the COO, the CTIO and the Group Risk function.

Key responsibilities

• Review client, partner and OEM contracts above an agreed threshold before signature, covering liability caps, indemnities, SLA credits, recovery commitments, data terms, audit rights and exit clauses, and keep client commitments matched to partner obligations
• Run the third-party lifecycle for critical suppliers and partners: due diligence, tiering, scorecards, annual financial-health reviews, revenue-share reconciliation, exit plans, and client due diligence and sanctions checks for new external and cross-border clients
• Own the business continuity management system (ISO 22301): refresh the impact analysis, set recovery targets per critical service, run the annual exercise programme including recovery tests for client platforms, the SOC and NOC and joint tests with bank clients, and validate recovery before new SLAs are signed
• Set up crisis management: a named crisis team with legal and communications leads, a single crisis protocol with the CISO and Marketing, and a ransomware playbook
• Maintain the risk register, controls, indicators, actions and loss events in Sentra; produce the monthly EMC dashboard, the monthly exception report and the quarterly Group submissions on time, and monitor risk appetite, client concentration and revenue at risk
• Track audit, regulatory and certification findings to closure
• Run the risk champion network and the annual risk and control self-assessment in every practice

Required profile

• 7+ years in enterprise, operational or vendor risk in a bank, insurer, telco or technology services firm
• Strong contract literacy, with experience of IT outsourcing, cloud and managed-service contracts
• Experience leading risks across Legal, Credit, Market, Liquidity, Strategic and Operational categories

Required skills

• ISO 22301 Lead Implementer or Auditor, or CBCI/MBCI
• GRC platform experience
• IRM certificate, CRISC or CTPRP is an advantage