Senior Technology Risk and Compliance Analyst

• Annual Incentive Scheme to reward your dedication and hard work
• 25 days annual leave (plus bank holidays) and an opportunity to purchase additional holiday days
• Electric Vehicle scheme via Octopus and cycle to work scheme
• Health Cash Plan: Supporting you with your everyday healthcare needs 
• Wellness Support with access to mental health resources, digital health checks, and & nutritionists through Aviva Digicare+ Workplace
• Exclusive Discounts through our United Rewards platform, giving you access to exclusive deals from the club and partners
• Gym Facilities in our onsite locations and opportunities for regular social events and team-building activities
• Enhanced family Leave Benefits and policies
• Enhanced Career Development with access to professional learning platforms like LinkedIn Learning, and internal training programs
• A Supportive Work Environment that values diversity, equity and inclusion, and individual growth

Key Responsibilities

• Maintain and develop Manchester United's IT risk and compliance framework, including IT risk registers, policies, standards, assurance plans and governance reporting.
• Support compliance with IT SOX, PCI DSS, UK GDPR and internal policy requirements by defining controls, coordinating testing, reviewing evidence and tracking remediation activities.
• Conduct risk and compliance assessments for technology projects, system implementations and significant technology changes, ensuring risks are identified, assessed and managed appropriately.
• Lead technology and cyber due diligence activities for suppliers, procurements, contract renewals and service changes, assessing security, privacy, resilience and contractual risks and monitoring remediation actions.
• Identify, assess and monitor technology and cyber risks, maintaining risk registers, supporting governance forums and escalating material risks and control issues where required.
• Coordinate and evaluate IT General Controls (ITGCs), including access management, change management, vulnerability management, backup and recovery, data protection and incident management controls.
• Support internal and external audits, maintain control documentation and contribute to the continuous improvement of risk, control and assurance processes.
• Support operational resilience activities, including disaster recovery, business continuity, resilience testing and the tracking of actions arising from incidents, audits and assurance reviews.
• Prepare management information, dashboards and reporting on risk, compliance and control performance, building effective relationships with stakeholders, auditors, assessors and suppliers.

Skills & Expertise

• Demonstratable experience in IT controls, IT audit, technology risk, cyber GRC, information security assurance or a related area.
• Practical experience of IT general controls, ideally in a SOX or similar controlled environment.
• Experience reviewing control evidence and identifying weaknesses.
• Understanding of access, change management and IT operational controls.
• Experience of supplier security assessments, third-party risk or cyber risk.
• Strong analytical skills and attention to detail.
• Clear written communication and the confidence to constructively challenge stakeholders.
• Ability to work independently and manage multiple priorities.

• CISA, CRISC, CISM, ISO 27001 or another relevant qualification, completed or in progress.
• Experience reviewing SOC 1 or SOC 2 reports.
• Familiarity with NIST CSF, ISO 27001 or COBIT.
• Experience with Microsoft 365, Azure, enterprise SaaS or GRC tooling.