IT & Data Privacy Risk Manager

Humanity is facing fundamental challenges, with the future of our planet hanging in the balance. As the principal investment arm of the Legal & General Group, our aim at Legal & General Capital is to generate long-term shareholder value, while helping build a better society. We seek opportunities to invest in sectors most in need of investment and innovation, such as residential housing, large-scale urban regeneration and future cities. We’re backing investment in infrastructure and clean energy, and in start-up businesses to drive innovation and growth across the UK. We’re building partnerships between the public sector and institutional investors to accelerate housing delivery, create jobs, support local businesses and transform communities. This helps to create new asset classes for Legal & General’s varied investment requirements, our partners and the wider marketplace. 

We are currently recruiting an IT & Data Privacy Risk Manager to join our team.

In this role, you will support the L&G Capital (LGC) Risk team in the oversight of the design, implementation, and effectiveness of the LGC’s technology and data risk and control framework, and adherence to the relevant Group and Divisional technology, information and data security policies.

The role will be varied including advising, maintaining oversight and challenging LGC and its subsidiary businesses on risk management activities relating to technology, information security, and data privacy and protection matters and risks.

What you'll be doing

• Risk and Control Framework: Supporting divisional stakeholders to ensure effective implementation and embedding of the technology and data protection policies, standards and controls in a consistent manner to minimise risk exposure, supported by accurate and timely measurements and reports, as needed.
• Assurance Reviews: Leading on, coordinate and maintain assurance activities across LGC and its operating businesses, in line with LGC’s Risk Management and Internal Control Frameworks and relevant Group Policies reporting to senior management, Group and/or LGC’s Risk Committees on the adequacy and effectiveness of the division’s design and operation of key technology, information security, data privacy and protection risks and controls.
• Technology & Data Risk Subject Matter Expertise: Acting as a subject matter expert by providing advice, guidance, and on-going support to LGC and its operating businesses regarding key technology, information security, and data privacy and protection risk governance, policy interpretation and application, intermediary to Group DPO and CISO, whilst also obtaining appropriate risk intelligence as part of discharging oversight responsibilities.
• Risk and Control Data Analysis: Exploiting operational data within the LGC’s risk management systems (including OneSumX, ServiceNow, Prevalent) to build holistic views of the technology and data privacy risk and control environment, and related measures and metrics to assess that risk exposures are within acceptable tolerances.
• Change & Transactional Assurance: Providing support, oversight and assurance over Direct Investment transactions and Divisional/Group related change programmes by advising and opining on the projects or transactions risks and controls, enabling key stakeholders and governing bodies make risk-informed decisions.
• Risk Event Analysis: Providing oversight, support investigations and perform analysis of risk events, data breaches, cyber security threats and any other technology incidences, which impact LGC and/or its operating businesses, including determining resolution and remediation, trending, and reporting on broader lessons learnt to drive improvements in the wider technology and data privacy risks and controls. This may also require supporting any production of specific risk reports and provision of data for regulatory submissions.
• Report Preparation: Collating and aggregate divisional risk registers and risk acceptances to produce reports for the LGC Risk Committee, LGC Operational Risk Committee and Group Technology Risk Committee. Liaise with 1st line and operating businesses to prepare and review inputs for committee papers to enable discussion and decisions.
• Health & Safety: Acting in accordance with the company’s H&S arrangements and procedures and to undertake the appropriate training required to ensure that they can carry out their role with due consideration to the safety and wellbeing of themselves and others.

What we're looking for

• Technology/IT/Computing degree level or equivalent industry experience
• A technology risk management, auditing or similar qualification would be beneficial but is not essential (i.e. CRISC, CISA, CISSP, Practitioner Certificate in Data Protection)
• Demonstrable knowledge of technology risk and control practices, including such frameworks as, ISO27001, COBIT, NIST RMF / CSF / 800-53
• Knowledge of approaches to data analysis and use of data analytics is beneficial
• Ability to use data to provide meaningful assessments and reports 
• Good understanding of technology including applications, security, service and infrastructure management, databases, servers, middleware, messaging, mainframe and networks
• Good understanding of GDPR regulation, including regulatory reporting and response to data breaches.
• Good understanding of IT, Information Security & Data Privacy risks, including confidentiality, integrity, availability, authenticity.
• Good understanding of operational IT resilience and how it impacts on service availability, continuity, change, supplier, incident, capacity and cyber event resilience
• Ability to express independent thoughts and opinions, along with maintaining ownership of and effective delivery of work deliverables and collaboration to support others in timely task delivery
• Strong stakeholder management – building long-term collaborative relationships internally and externally through strong inter-personal skills with engaging a range of seniority levels, along with effective written and verbal communication skills

When you commit to Legal & General, we’ll commit to you too. That means we’ll recognise and reward your hard work, your performance and your contribution.

If you join us, you’ll get access to some great benefits, including private medical insurance, 27 days holiday (excluding bank holidays), a generous pension scheme, life assurance, and Income Protection. You can participate in our electric car scheme, which offers employees the option to hire a brand new electric car through tax efficient salary sacrifice. We’re also proud to offer competitive family leave. 

You’ll have the opportunity to participate in our annual, performance-related bonus plan and valuable share schemes. And then there are the many discounts we offer that you can take advantage of – both for our own products and at a range of high street stores and online offerings. 

The brand with the brolly is choosing today to change tomorrow.

Since 1836, we’ve grown to become one of the world's largest asset managers, homebuilders, pension providers and insurance brands. 

We’re all here to improve the lives of our customers, build a better society for the long term, and create value for our shareholders - helping to shape a better future for society and the planet.

We need people who share our ambitions, agility and entrepreneurial spirit to help us do it.

At L&G, you’ll find a balance that helps you be your best. Empowered by hybrid working, we’re supported by technology and workplaces that enable us to work effectively wherever we are. We come together in offices to collaborate and connect, and use time at home for individual, focused activities. And, when we achieve great things, we celebrate our success and reward strong performance.

Today, there’s over 10,000 of us, working towards our mission, with plenty of opportunities to grow your career as we grow L&G. Will you join us?

Great minds don’t have to think alike, so we welcome voices from all backgrounds. Bringing together people with different life experiences helps us build empathy with our customers and drive innovation.

We don’t just talk about it, we actively promote diversity and equitable opportunities for all. That means our employment decisions are made without regard to race, colour, religion, national or ethnic origin, sex, sexual orientation, gender identity or expression, age, disability or protected veteran status. In fact, we embrace every dimension of diversity to reflect the customers and communities we serve.

We think it’s important to create an inclusive environment where we can all belong, contribute and drive progress, where you can develop and grow, and be empowered. We want you to use your voice to help us build a better tomorrow.

We all work differently, and have different needs, which is why. we’re always open to discussing flexible working arrangements. Likewise, we’re committed to finding reasonable accommodations for candidates with specific needs during our recruiting process.

So whoever you are, wherever you are, whatever your story, we'd love to hear from you.