Risk Change Manager - Ops Resilience & Third Party Risk

We’re looking for a Risk Change Manager (Operational Resilience & Third Party Risk) to help make Zopa’s risk frameworks simpler, smarter and easier for the business to use.

Operational Resilience and Third-Party Risk Management are already well established at Zopa. Now we’re looking for someone to take them to the next level, improving the way we work, reducing friction, strengthening ownership and making sure our frameworks are practical, scalable and genuinely valuable.

This is a hands-on role for someone who enjoys turning complex requirements into clear, intuitive processes. You’ll work closely with Procurement, Supplier Relationship Managers, business owners and SMEs across areas like Information Security, Data Privacy, Financial Crime, Compliance and Legal to help teams manage risk confidently and effectively.

A day in the life:

• You’ll own and improve Zopa’s first-line frameworks for Operational Resilience and Third-Party Risk Management, creating clearer guidance, better templates, smoother workflows and stronger governance.
• You’ll lead practical improvements that make a real difference, reducing assessment time, improving the quality of risk information, clarifying ownership, speeding up approvals and giving senior leaders better visibility of material risks.
• You’ll also own key Operational Resilience activity, including Zopa’s Self-Assessment, Important Business Services, impact tolerances, dependencies, vulnerabilities and resilience testing.
• On the Third-Party Risk side, you’ll oversee the material third-party register, embed risk requirements into supplier processes and support ongoing monitoring, BCP and exit planning for higher-risk suppliers.

About you:

• You’re great at simplifying complex frameworks, processes or governance into practical ways of working that people actually use.
• You’ll bring strong judgement, a process design mindset and the ability to apply requirements proportionately in a fast-paced, regulated environment.
• You’ll be comfortable learning new regulatory requirements, risk domains and technical subject matter, then translating them into effective business processes.
• You’ll also have experience in Operational Resilience and Third-Party Risk Management, whether from a regulatory, technology or operations perspective, and be confident using data and technology to support decision-making while balancing risk with commercial goals.