Location: UK, London
Company: Maples Group
Own the governance, oversight, and regulatory reporting for the firm’s operational resilience programme across the Maples Group operating jurisdictions. Drive strategic planning and tactical implementation for global operational resilience. Support compliance with regulations, standards, and frameworks such as the Digital Operational Resilience Act (DORA) and related ISO standards. Establish and maintain policies, standards, and control frameworks; deliver practical solutions to protect the business; provide high-quality business-level advisory to senior leadership; and embed a culture of resilience across the enterprise and supply chain. Collaborate with the business continuity, crisis management, information security, and broader risk, compliance, and legal functions as well as impacted business areas.
Job role
Governance, framework, and policy
- Lead the design, implementation, and maintenance of the operational resilience framework, policies, standards, and minimum control requirements, aligned to DORA and other such frameworks.
- Maintain a clear RACI model, linking operational resilience responsibilities to the enterprise risk, IT risk, cyber security, business continuity management (BCM), crisis management, and third-party risk management (TPRM) frameworks.
- Ensure resilience requirements are embedded in change/governance processes (e.g., product change, major transformation, and cloud migration).
Regulatory compliance and readiness
- Interpret and operationalize regulatory obligations across DORA pillars (ICT risk management, incident management and reporting, digital operational resilience testing, ICT third-party risk management, and information sharing) and general operational resilience principles (important business services, impact tolerances, mapping, scenario testing, and self-assessment).
- Maintain an operational resilience self-assessment and DORA body of evidence (policies, procedures, mappings, registers, and test results) to be available for regulatory inspection.
- Coordinate regulatory submissions, requests for information, and responses to regulatory findings with compliance and impacted boards; track remediation to closure.
MI, metrics, and board reporting
- Design and maintain MI dashboards and KRI/KPI suites covering incident trends, resilience maturity, testing performance, impact tolerance status, third-party resilience, remediation progress, and audit/regulatory actions.
- Produce monthly/quarterly reports for senior management, governance committees, and the board; ensure accuracy, timeliness, and a clear narrative.
Mapping, business services, and impact tolerances
- Facilitate identification and mapping of important business services and critical/important functions, covering people, process, technology, data, facilities, and third-party dependencies.
- Coordinate the definition, approval, and periodic review of impact tolerances, including measurement approach, scenarios, and escalation criteria.
Scenario testing and assurance
- Plan and execute the resilience testing lifecycle (tabletop, end-to-end, third-party disruption simulations, and ICT/cyber outage scenarios), with risk-based scope and control objectives.
- Maintain test evidence, findings, risk acceptance, and remediation tracking, ensuring lessons learned inform policy, standards, and future testing.
- Provide second-line challenge and thematic reviews; partner with compliance for risk-based assurance; and liaise with internal audit on their independent testing requirements.
Incident management and post-incident learning
- Oversee incident classification and regulatory notification workflows in line with DORA requirements and defined timeframes.
- Coordinate root-cause analysis, lessons learned, trend analysis, and control enhancements; ensure recurring issues are addressed through targeted remediation and governance follow-up.
ICT third-party resilience and concentration risk
- Partner with TPRM to maintain the register of ICT third-party providers and ensure minimum contractual clauses, monitoring, testing participation, and exit/transition plans.
- Assess concentration risk and systemic dependency exposures; support control design for multi-vendor/geographic diversification and resilience attestation.
Stakeholder engagement and culture
- Chair cross-functional resilience working groups; drive shared accountability across IT, risk, cyber security, BCM, compliance, procurement, and business units.
- Design and deliver targeted training and awareness (by role and function), including playbooks, decision rights, and executive exercises.
Tools, data, and taxonomies
- Oversee MI data quality, taxonomy alignment (incidents, services/functions, impacts, and dependencies), and effective use of GRC/IRM platforms (e.g., ServiceNow) for evidence and reporting.
Deliverables and success measures
- Approved operational resilience framework, policies, and standards aligned to DORA.
- Up-to-date mapping (critical functions), impact tolerances, and third-party registers.
- Annual self-assessment and complete DORA body of evidence.
- Executed risk-based testing plan with timely closure of findings.
- Regulatory engagements with no material findings or overdue actions; improved audit outcomes.
- Clear, consistent MI and board reporting with measurable resilience improvements.