Location: London, UK or Tallinn, Estonia | Hybrid
Reports to: Group Chief Compliance & Risk Officer / MLRO
Function: Second line risk, independent of the FinCrime/AML line (Deputy MLRO)
Type: Permanent, full-time
About Pockit and Monese
Pockit and Monese are all-in-one money apps that make it easier for people to access and manage the financial tools they need to take control of their money.
We provide vital financial services, from accounts and cards to income advance solutions. In October 2024, Pockit acquired Monese, bringing together two complementary businesses and creating a leading fintech company focused on serving people who are underserved by traditional banks.
Together, we serve more than three million customers across the UK and Europe.
We're a diverse, international and energetic team, with colleagues based across London, Newcastle, Tallinn and remote teams across Central Europe. We value curiosity, ambition, accountability and resilience, and we want everyone to feel at home, have a voice and know that their contribution matters. We give people the trust and space to take ownership, share ideas, influence decisions, and make a real impact on our customers and our business.
Role Purpose
We are looking for a hands-on Head of Risk & Operational Resilience to own, build, and run our operational and prudential risk capabilities across Monese.
In this role, you will be the accountable owner for our operational resilience framework- specifically focusing on wind-down planning, business continuity, incident management, and third-party/outsourcing risk management in accordance with FCA expectations and DORA standards.
This is a build-and-run, individual contributor role initially. You will close current resourcing gaps across all three areas and build the underlying risk management toolkit (KRIs, control self-assessment, risk event log) needed to run them sustainably.
What you'll do
1. Risk Framework & Audit Interface
- Own the Risk & Control Self-Assessment process and a KRI framework across all operational areas.
- Maintain an operational risk event log with clear escalation, investigation, and remediation tracking.
- Act as primary liaison for internal and external audit on wind-down, incident management, and TPRM matters; align control design with audit recommendations
2. Third-Party & Outsourcing Risk ManagementRegulatory basis: DORA Art. 28–44; EBA/GL/2019/02; FCA SYSC 8; Operational Resilience (PS21/3), including mapping of third parties supporting important business services
- Own the Third Party Risk Management framework, running rigorous risk assessments, ensuring due diligence is performed, maintaining the DORA Register of Information, and guaranteeing that robust exit strategies are in place for critical vendors.
- Ensure TPRM aligns with BCP maintaining the mapping of critical third parties against important business services
3. Operational Risk Management & Wind-Down Planning
Regulatory basis: Electronic Money Regulations 2011; EBA/GL/2021/11
- Map out critical business services and be the primary author of the firm's board- and FCA-approved Wind-Down Plan (WDP) and Business Continuity Plans (BCP), ensuring the firm can weather operational crises without harming consumers
- Design and run the WDP and BCP testing programme - scenario testing, timeline/resource feasibility checks, and business impact analysis - evidencing the plan works operationally, not just that it exists
- Benchmark against the FCA's 2025 multi-firm WDP review and the shift in supervisory tone (e.g. PS25/12) from document-existence to demonstrated execution capability
Governance & Reporting:
- Feeds risk MI into the Risk Committee and Board reporting owned by the CCRO/MLRO
- Collaborate with the Deputy MLRO on third-party or incident matters with a financial-crime dimension, without owning fincrime risk itself.
What you'll bring
- Track record building or running a second-line operational/prudential risk function in a UK-regulated payments, e-money, or banking firm.
- Direct experience with wind-down/recovery planning under EMR 2011/PSR 2017 or equivalent prudential regimes.
- Hands-on incident management and resilience testing experience - able to design and run simulation exercises, not just write policy.
- Practical DORA implementation experience (Art. 17–23 incident reporting; Art. 28–44 third-party risk), given Monese's EU entity exposure.
- Outsourcing/TPRM experience including fourth-party due diligence
- Experience running KRI/CSA frameworks and acting as an audit liaison
- Comfortable operating with limited team resource initially - this is a build-out role
Why Join Us?
- Make a real difference: Work at the intersection of technology and financial inclusion, helping people take greater control of their money.
- Have a voice: Your ideas and perspective matter. You'll have the opportunity to influence decisions, take ownership and shape how we work.
- Make an impact: Work on initiatives that reach millions of customers across the UK and Europe.
- Work with great people: Join a diverse, international and ambitious team where collaboration and curiosity are encouraged.
- Grow with us: Be part of a fast-moving fintech where you'll have plenty of opportunities to learn, develop and make your mark.
What benefits we offer
We want you to feel supported, valued and able to do your best work - both in and outside the office.
- 25 days annual leave + public holidays, with an extra day for every year worked
- Healthcare: Private medical with Confido, sports compensation with Stebby or discount from a gym or Bupa personal private healthcare
-
Generous pension plan
-
10 paid sick days per year
- Hybrid working + up to 30 days working abroad each year
- L&D budget + 10 paid learning days per year
-
Annual eye care allowance
-
Enhanced maternity, paternity and shared parental leave
-
VIP Pockit & Monese accounts
- Extra paid days off for your birthday and wedding
-
Regular social events and team activities
- Monthly recognition awards and Team of the Quarter
- Share options, depending on role and level
-
Employee referral bonus
-
Free office parking
The use of AI tools or applications during interviews is not permitted.
We value a fair, transparent, and authentic recruitment process. Candidates are expected to participate in all stages of the interview process personally and to represent themselves accurately.
The use of AI interview proxies, real-time AI co-pilots or answer-generation tools, deepfakes, impersonation, synthetic identities, or any other technology intended to misrepresent a candidate’s identity, skills, experience, or responses during the interview process is strictly prohibited.
Any candidate found to be using such methods will be automatically disqualified from the recruitment process.
We kindly ask all candidates to respect the time and effort invested by both sides and to approach the interview process with honesty, professionalism, and integrity. If you are genuinely interested in the opportunity, we look forward to meeting you and learning about your own experience, skills, and perspective.
