Operational Resilience and Continuity Manager (DORA)

Operational Resilience and Continuity Manager

Location: Edinburgh preferred, with other UK locations considered
Working arrangement: Flexible hybrid working with occasional travel to Edinburgh
Salary: £63,000 to £80,000 plus benefits
Contract: Permanent
Management responsibility: Individual contributor

The Opportunity

We are recruiting an Operational Resilience and Continuity Manager for a growing financial services and investment technology business.

The organisation is directly in scope for the EU Digital Operational Resilience Act and is strengthening its wider operational resilience, business continuity and incident management capability.

This is a hands on role for someone who can interpret detailed regulatory requirements and technical standards, assess the current position and translate them into practical business actions.

The immediate priority is to assess current arrangements against DORA and FCA Operational Resilience requirements, identify gaps and establish a clear, prioritised remediation plan.

You will also own the business continuity management capability, improving business impact assessments, continuity plans and incident arrangements while embedding them into business as usual operations.

The role will suit a technically strong, pragmatic individual who can apply proportionate judgement and deliver improvements through to completion.

Role Purpose

You will lead the development, implementation and maintenance of the organisation’s business continuity capability within its wider operational resilience framework.

You will help ensure important business services can continue through disruption, recover within agreed tolerances and remain supported by effective people, processes, technology and third party arrangements.

You will lead the interpretation and implementation of DORA requirements, working across operations, technology, information security, risk, compliance, procurement and third party management.

Key Responsibilities

DORA Compliance and Regulatory Implementation

• Interpret DORA, the relevant Regulatory Technical Standards and FCA Operational Resilience requirements
• Translate regulatory obligations into clear, practical business requirements and controls
• Assess current arrangements, identify regulatory and control gaps and define required improvements
• Develop and manage a prioritised remediation plan with clear actions, owners and target dates
• Track actions through to completion and ensure remediation creates sustainable controls
• Maintain appropriate evidence, governance, management information and regulatory reporting
• Support the organisation ’ s ICT risk management framework and work with technology teams to address vulnerabilities and control weaknesses
• Monitor regulatory developments and assess their impact on processes, controls and operating models

Business Continuity Management

• Own and develop the business continuity management framework, embedding it into business as usual operations
• Establish clear standards, ownership and review cycles
• Facilitate business impact assessments covering critical activities, recovery requirements and key dependencies
• Work with business owners to develop and maintain practical, consistent business continuity plans
• Ensure plans reflect current people, processes, systems, data, premises and supplier dependencies
• Develop appropriate recovery strategies aligned to important business services
• Maintain documentation and evidence for regulatory, audit and assurance purposes

Operational Resilience

• Maintain important business services, impact tolerances and supporting resource maps
• Identify vulnerabilities across people, processes, technology, data, facilities and third parties
• Assess whether arrangements can support delivery within agreed impact tolerances
• Work with service owners to strengthen resilience controls and recovery arrangements
• Embed resilience considerations within change programmes, product development and business planning
• Support clear ownership and provide evidence for FCA reviews, internal audit and external assurance

Incident and Crisis Management

• Review and improve incident and crisis management arrangements, including roles, responsibilities and escalation routes
• Work with operational and technology teams to strengthen incident identification, classification and escalation
• Assess ICT incidents against internal and regulatory thresholds and support DORA reporting where required
• Ensure incident records are accurate and supported by appropriate evidence
• Facilitate post incident reviews to identify lessons, recurring themes and control weaknesses
• Agree and track remediation actions through to completion
• Support senior stakeholders during significant operational disruption

Resilience Testing and Exercising

• Design and coordinate business continuity, operational resilience and crisis management exercises
• Develop credible scenarios based on realistic threats, vulnerabilities and dependencies
• Test plans, controls, communications, escalation and decision making against agreed impact tolerances
• Support the DORA testing programme, ensuring it covers critical systems and ICT dependencies
• Assess outcomes, report findings and track agreed improvements through to completion
• Use testing results to strengthen plans, controls and overall resilience capability

Third Party and ICT Supplier Resilience

• Assess operational resilience and DORA compliance across material third party ICT arrangements
• Work with procurement, legal, technology and business teams to understand supplier dependencies
• Review supplier continuity, recovery and incident management arrangements
• Identify concentration risks, dependency risks and potential single points of failure
• Maintain required DORA information registers and supporting third party records
• Review relevant contractual provisions, including resilience, audit, incident notification and exit arrangements
• Reflect material dependencies within impact assessments, continuity plans and testing
• Recommend proportionate mitigation and support supplier assurance activity

Technology Resilience

• Identify critical systems, applications, infrastructure, data and technology dependencies
• Align technology recovery and disaster recovery arrangements with business priorities
• Contribute to technology resilience testing and ICT incident exercises
• Ensure technology risks and vulnerabilities are reflected within resilience reporting and remediation plans
• Embed resilience requirements within technology and infrastructure change

Governance and Reporting

• Produce clear reporting for senior management, governance committees and Board audiences
• Provide visibility of material risks, regulatory gaps, remediation progress and required decisions
• Develop meaningful management information and key risk indicators
• Use incidents, testing, assurance findings and risk data to identify trends
• Present complex regulatory and technical matters in clear business language
• Maintain accurate records, escalate significant risks and provide constructive challenge

Continuous Improvement

• Improve resilience processes, documentation and reporting through effective tooling and automation
• Develop practical templates, standards and guidance
• Reduce unnecessary manual activity and duplication
• Promote awareness, training and business ownership of resilience responsibilities

Experience and Knowledge

The successful candidate will have substantial experience within operational resilience, business continuity, operational risk, technology risk or a related discipline.

Experience within financial services, fintech, investments, banking, insurance or another regulated environment would be particularly relevant.

You should be able to demonstrate some of the following:

• Strong practical knowledge of DORA and the relevant Regulatory Technical Standards
• Experience supporting or leading a DORA implementation or readiness programme
• Experience completing regulatory gap assessments and managing remediation plans
• Strong knowledge of FCA Operational Resilience requirements
• Practical business continuity experience, including business impact assessments and continuity plans
• Understanding of ICT risk, operational incidents and crisis management
• Experience designing and facilitating resilience exercises
• Understanding of third party risk and supplier resilience
• Experience working with technology and information security stakeholders
• Experience producing governance reporting for senior stakeholders
• Strong communication, documentation and influencing skills
• The ability to work independently, take ownership and apply pragmatic judgement

Desirable Experience

The following would be helpful but is not essential:

• Experience within an investment platform, wealth management business or fintech
• Experience within an organisation directly in scope for DORA
• Knowledge of DORA incident reporting and third party information register requirements
• Experience reviewing ICT supplier contracts and resilience provisions
• Knowledge of ISO 22301 or a business continuity qualification such as CBCI or MBCI
• A relevant risk or information security qualification, or experience supporting regulatory and assurance reviews

Personal Approach

The successful person will be practical, credible and comfortable taking ownership, recognising where firm action is required while remaining proportionate.

You are likely to be:

• Pragmatic and solutions focused
• Comfortable working independently and through ambiguity
• Curious about how the business operates
• Confident providing constructive challenge to senior and technical stakeholders
• Collaborative and focused on practical implementation
• Persistent in following actions through to completion
• Able to balance regulation, risk, customer outcomes and commercial reality

What Success Will Look Like

During the first twelve months, the successful individual is expected to have:

• Completed a detailed DORA assessment and identified material regulatory, technology and resilience gaps
• Established an agreed remediation plan with clear ownership and governance
• Improved ICT incident management and regulatory reporting capability
• Strengthened third party ICT risk oversight and information records
• Improved the digital operational resilience testing programme
• Embedded DORA requirements into business as usual processes
• Improved the quality and review of business impact assessments and continuity plans
• Provided clear senior reporting and built productive relationships across the business

Why Consider This Role

This is an opportunity to take genuine ownership of an important regulatory and operational resilience agenda within a growing financial services business directly in scope for DORA.

You will have the freedom to assess the current position, influence how requirements are implemented and help deliver the required improvements.

The position offers:

• A salary of £63,000 to £80,000 depending on experience
• A comprehensive benefits package
• Flexible hybrid working within an Edinburgh based team
• Meaningful ownership without direct line management responsibility
• Exposure to senior stakeholders and governance forums
• The opportunity to shape DORA compliance, business continuity and operational resilience

Edinburgh is the preferred location, although candidates based elsewhere in the UK may be considered. Travel to Edinburgh would only be required occasionally.

Interview Process

The first stage will be a conversational interview with the hiring manager, exploring your career history, relevant experience, motivation and approach.

The second stage will be technically focused and will involve a practical scenario covering DORA, operational resilience, business continuity, incident management or third party risk.

The discussion will assess how you identify the issue, evaluate the risk, engage stakeholders and develop a proportionate solution. The organisation values thoughtful, practical responses rather than automatically stopping an activity or terminating a supplier.