Risk & Controls Manager

About Pleo
Messy spend management is tricky business. And tedious processes are a lose-lose situation for all involved, not just finance. At Pleo, we're changing that. We build spend solutions that make managing money seamless, empowering, and surprisingly effective for finance teams and employees alike - with a vision to help all businesses ‘go beyond’.
The word ‘Pleo’ actually means ‘more than you’d expect’, and living by that mantra has been the secret to our success over the last 10 years.
Now, we’re at a pivotal moment in our journey; every move we make has a direct impact on our 40,000+ customers, our business, and our collective success. We need people who take pride in uncovering customer needs, who turn complex problems into simple solutions, challenge the way things are done (respectfully), and always aim high. With great ambitions driving us forward, we can’t say we’ve got this whole thing figured out. And frankly, that’s half the fun! What we can say is that we’re a driven, progressive, and, importantly, a kind bunch of 850+ people from over 100 nationalities, all committed to delivering the future of business spending, together.
About the role
We're looking for a Risk and Controls Manager to join our Risk & Controls team, part of Pleo's Second Line of Defence. You'll report to our Head of Risk and Controls, helping build and run our enterprise risk management framework, from risk appetite linkage through to the risk reporting our senior leaders and committees rely on. Alongside that full ERM remit, you'll own second line oversight of security, technology and operational resilience risk, giving our technology and security teams informed, credible challenge. It's a rare mix: a broad enterprise risk role with a technology risk specialism, in a FinTech that's still shaping how it manages risk as it scales. We value people from a range of risk backgrounds, so if you match most of what's below, we'd love to hear from you.

Who you'll be working with and reporting to
You'll work closely with other members in our Risk and Controls team, the security GRC team in the First Line, as well as teams across Product, Engineering, Operations, Finance and Compliance.

What you’ll be doing
As a Risk Manager, you will:
Build and run our ERM framework: Work closely the Head of Risk and Control on our enterprise risk management framework, including risk appetite, how it links to our risks and controls, and the reporting that goes to senior management and governance committees.

Own technology and security risk oversight: Lead 2LOD oversight of information security, technology and operational resilience risk, setting the methodology and standards and challenging the First Line on where the gaps are.

Test our IT general controls: Run ITGC testing with our technology and security teams, assessing whether controls are well designed and working in practice.

Lead high-risk testing when incidents happen: Partner with our Assurance & Controls Manager to lead incident-driven testing in our highest-risk areas and turn findings into clear actions.

Run risk assessments and RCSAs: Lead risk assessments and risk and control self-assessments across the business, not just in technology.

Shape our GRC tooling: Run GRC tools and help decide how we bring more structure and automation to how we manage risk.

Be a trusted risk partner: Advise First Line teams on risk, regulatory change and the control environment, and support our engagement with regulators.

Right now we're broadening what the team covers. We already have strong financial and credit risk skills in the team. This hire closes our gap in technology risk and gives us a second person who can run enterprise risk management end to end. You'll work across a risk universe that spans technology, information security, privacy and operational resilience, alongside product, operational and financial risk.

What you bring You’ll thrive in this role if you have:
Enterprise risk man