Global Head of Operational Resilience

Ebury helps ambitious businesses unlock global growth, and we take the same approach with our people. We encourage innovation and movement, collaboration and problem-solving, and foster an environment where everyone can feel they belong, are valued, supported and empowered to succeed. If you’re a collaborator who wants to help transform how businesses operate globally, get in touch - we’d love to discuss how Ebury can accelerate your career so you can shape the future. Global Head of Operational Resillience Risk Management Ebury Madrid Office - Hybrid: 4 days in the office, 1 day working from home per week The Global Head of Operational Resilience is a strategic leadership role responsible for safeguarding Ebury’s technology, security, and digital assets. Acting as a key second line of defense, you will ensure effective integration of Operational Resilience into the overarching second line Risk Management Framework, including alignment with Digital Operational Resilience Act (DORA) / PS21/3 (UK), Third-Party Risk Management (TPRM), and Incident & Crisis Management expectations. Working with the senior leaders in Technology and stakeholders across the company, you will take ownership of the Technology Risk Management Framework and drive a holistic, integrated risk strategy that protects critical business functions from systemic disruption. This role would suit a candidate from risk management across any of the three lines of defence, as well as more technical candidates seeking to transition to a second line oversight role. Reporting to the CRO at Director level, this is a key role as Ebury enters a crucial phase of development and maturity over the coming years. What you’ll do You will own, manage and control Technology Risk and Resilience mandates, metrics and all internal processes for the Ebury globally. Manage and continuously improve the Ebury’s Information Technology (IT) Risk Management through oversight of technology, security and data risks and controls aligned with ISO 27001 and related to the company's business processes and IT assets. Oversee enterprise-wide implementation and adherence to the Digital Operational Resilience Act (DORA) and PS21/3 (UK), incident and crisis management. Ensure all vendor contracts strictly incorporate DORA-mandated provisions, security expectations, and exit strategies. Conduct ongoing due diligence and continuous risk assessments of critical or important functions (CIFs) outsourced to third parties. Provide independent oversight of the Group Security function, ensuring that the firm's cybersecurity posture is aligned with industry frameworks Challenge, assess, and assure the effectiveness of security controls (identity & access management, encryption, and vulnerability management), review and report incidents. Business Process Management mapping across all geographies, management and review of the 200+ business processes; Direct enterprise-wide operational resilience initiatives to ensure the firm can withstand and recover from severe disruptions or cyberattacks. Oversee annual digital operational resilience testing programs (e.g., threat-led penetration testing, vulnerability scans). Chairing the Digital and Operational Resilience Committee, IT Risk Management Committee and Outsourcing and Third Party Risk Management Committee. Develop metrics and reporting for the CRO and Board to keep them apprised of key technology, security, resilience and TPRM risks and material controls. Prepare evidence and lead interactions with regulatory bodies, supervisory authorities, and internal/external auditors in relation to Technology Risk and Resilience. What you’ll need At least 10 years experience of leadership in Operational Resilience, Technology Risk, or Technology Audit, ideally within a financial services environment. Experience of Risk Management in an Operational Resilience context English language proficiency required Experience of Financial Services and/or Auditing an advantage Finance,