WHO YOU'LL BE WORKING WITH AND REPORTING TO
You'll work closely with other members in our Risk and Controls team, the security GRC team in the First Line, as well as teams across Product, Engineering, Operations, Finance and Compliance.
WHAT YOU’LL BE DOING
As a Risk Manager, you will
Build and run our ERM framework: Work closely the Head of Risk and Control on our enterprise risk management framework, including risk appetite, how it links to our risks and controls, and the reporting that goes to senior management and governance committees.
Own technology and security risk oversight: Lead 2LOD oversight of information security, technology and operational resilience risk, setting the methodology and standards and challenging the First Line on where the gaps are.
Test our IT general controls: Run ITGC testing with our technology and security teams, assessing whether controls are well designed and working in practice.
Lead high-risk testing when incidents happen: Partner with our Assurance & Controls Manager to lead incident-driven testing in our highest-risk areas and turn findings into clear actions.
Run risk assessments and RCSAs: Lead risk assessments and risk and control self-assessments across the business, not just in technology.
Shape our GRC tooling: Run GRC tools and help decide how we bring more structure and automation to how we manage risk.
Be a trusted risk partner: Advise First Line teams on risk, regulatory change and the control environment, and support our engagement with regulators.
Right now we're broadening what the team covers. We already have strong financial and credit risk skills in the team. This hire closes our gap in technology risk and gives us a second person who can run enterprise risk management end to end. You'll work across a risk universe that spans technology, information security, privacy and operational resilience, alongside product, operational and financial risk.
WHAT YOU BRING
YOU’LL THRIVE IN THIS ROLE IF YOU HAVE
Enterprise risk management depth: Hands-on experience running an ERM or operational risk framework in a regulated financial services business (FinTech, banking, payments or similar), including risk appetite, risk reporting and RCSAs. You could step in for the Head of Risk and Control when needed.
Technology risk know-how: Hands-on experience applying security, technology and operational resilience risk methodology and standards, with enough depth to challenge technology and security teams credibly. You don't need to be an engineer.
Controls testing experience: A track record of ITGC testing or similar control testing and assurance work.
The ability to influence: Confidence engaging stakeholders on complex or sensitive risk topics, challenging constructively and being heard.
Clear, collaborative communication: The ability to translate risk concepts into practical language for everyone from engineers to senior leadership.
A pragmatic mindset: A drive to find workable answers to real risk challenges rather than defaulting to theory.
Nice to have
First Line experience, for example in an IT, security or GRC team before moving into second line risk
Experience with GRC tooling, including selecting or rolling out a platform
Exposure to data risk or AI risk
Experience at both a FinTech and a traditional bank or payments business
- HOW YOU’LL DEVELOP IN THIS ROLE
- IN YOUR FIRST 12 MONTHS AT PLEO, YOU’LL:
Get under the skin of Pleo's risk landscape and take ownership of key 2LOD review and challenge activities across priority business areas.
Play an active role in evolving our risk framework as the company continues to scale — contributing your expertise to initiatives that will shape how we manage risk for years to come.
Build strong relationships across the business, establishing yourself as a credible and trusted voice on risk matters.
We're committed to helping you grow here, whether that means deepening your technical expertise, expanding your regulatory knowledge, or stepping into broader leadership responsibilities as the team develops.
WHY IS THIS ROLE A GOOD FIT FOR YOU
This role is a good fit for you if
You've run enterprise or operational risk frameworks and want to go deeper on technology and security risk
You started in IT, security or technology risk and have since moved into broad, enterprise-wide risk management
You enjoy building and improving frameworks in a scaling business, and want to be a genuine deputy to the head of the function
This role is not a good fit for you if
Your experience is mainly First Line security or GRC work without broad enterprise risk management. This role covers the whole risk universe, not just technology
Your background is primarily consultancy, internal audit or compliance without substantial hands-on risk and control experience
You want a mature, settled framework to maintain. A lot of this role is building, testing and piloting while the business moves around you
HOW YOU'LL DEVELOP IN THIS ROLE
In your first 12 months at Pleo, you'll
Take ownership of key ERM framework deliverables alongside the Head of Risk and Control, including risk appetite linkage and committee reporting
Set our technology and operational resilience risk methodology and complete a full cycle of ITGC testing
Run a GRC tooling pilot through to a clear recommendation on how we manage risk at scale
As deputy to the head of the function, you'll get broad exposure to senior stakeholders and governance, with room to grow into wider leadership as the team develops.
THE INTERVIEW PROCESS
We want to ensure you are set-up for success and understand what will be expected of you. If your application is successful, our interview process is as follows:
Intro call: A 30-minute chat with our Talent Partner to discuss the role and your background.
Hiring manager interview: A conversation with our Head of Risk and Control.
Peer interview: A conversation with members of our Risk & Control team and other stakeholders.
Final interview: A conversation with our Chief Risk Officer.
SHOW ME THE BENEFITS!
Your own Pleo card (no more out-of-pocket spending!)
Lunch is on us for your work days - enjoy catered meals or receive a lunch allowance based on your local office
Comprehensive private healthcare - depending on your location, coverage options include Vitality, Alan or Médis
We offer 25+ days of holiday + your public holidays
For our Team, we offer both hybrid and fully remote working options
We use MyndUp to give our employees access to free mental health and well-being support with great success so far
Paid parental leave - we want to make sure that we're supportive of families and help you feel that you don't have to compromise your family due to work
Transparency is important to us so we also wanted to share some insights about what we're looking for in applications to ensure you can set yourself up for success!
Last time we hired a Risk Manager, we received a lot of applications but only meet with a select few. With this in mind, we want to help you understand what we really care about when reviewing your application:
We receive a lot of CVs, and many of them are AI-generated. We love seeing people leverage AI—it's a big focus for us internally too—but without human intervention, these CVs can sometimes become generic and fail to show a candidate in the best light. What we're really looking for is the specific details of real impact that only you—not AI—know from your previous experience. A top tip from us is to use the "Achieved X, as measured by Y, by doing Z" formula (credit: Laszlo Bock, ~2014) to give a really clear picture of what you've worked on. A final note: including links to your previous companies' websites is a huge help and allows us to truly understand your background.
Every single application we receive is reviewed by a human (yes, hundreds of them) because we believe that candidates' efforts should be matched by an equal level of human care. This means that we expect a similar level of attention put into your application. Read and answer the application questions carefully, they make a huge difference in our decision-making process.
ABOUT YOUR APPLICATION
English first. Since it's our company language, please submit your application in English. You’ll be using it a lot if you join us.
A fair look for everyone. Our talent team reads every single application to ensure the process is fair. To keep things running smoothly, we only accept applications through our system—our support team can’t pass on calls or emails.
Diversity drives us. We can only reach our goals if our team reflects the world around us. That starts with you hitting apply, even if you don't tick every single box. We encourage people from all backgrounds and experiences to join us.
Interview at your best. We want you to feel comfortable throughout the process. If you have any accessibility requirements or need a specific format, email belonging@pleo.io. We’ll design a process that works for you.
Your data is safe. When you apply, we process your personal data as a data processor. For more information on how Pleo processes personal data, read our Privacy Policy here https://www.pleo.io/en/legal.
Applying for multiple roles? Nothing is stopping you, and we assess every role independently. However, we do look for alignment, so make sure you can explain why your interest and experience are right for each specific role.
Reapplying. If you’re applying for the same role again, please wait six months from your last decision before hitting submit.
