Senior Technology Risk and Compliance Analyst

Plays a key part in administering the Club's IT risk and compliance programme, providing hands-on support across IT controls, supplier cyber risk and wider cyber risk management activities. It coordinates IT SOX compliance, PCI DSS, UK GDPR requirements, third-party assurance and technology change risk processes, including risk assessments, control testing, due diligence reviews, remediation tracking and reporting. As a senior individual contributor, the postholder works closely with control owners and stakeholders to review evidence, assess risks, identify control gaps and drive corrective actions to completion, while accountability for control operation remains with the business.

• Maintain and develop Manchester United's IT risk and compliance framework, including IT risk registers, policies, standards, assurance plans and governance reporting.
• Support compliance with IT SOX, PCI DSS, UK GDPR and internal policy requirements by defining controls, coordinating testing, reviewing evidence and tracking remediation activities.
• Conduct risk and compliance assessments for technology projects, system implementations and significant technology changes, ensuring risks are identified, assessed and managed appropriately.
• Lead technology and cyber due diligence activities for suppliers, procurements, contract renewals and service changes, assessing security, privacy, resilience and contractual risks and monitoring remediation actions.
• Identify, assess and monitor technology and cyber risks, maintaining risk registers, supporting governance forums and escalating material risks and control issues where required.
• Coordinate and evaluate IT General Controls (ITGCs), including access management, change management, vulnerability management, backup and recovery, data protection and incident management controls.
• Support internal and external audits, maintain control documentation and contribute to the continuous improvement of risk, control and assurance processes.
• Support operational resilience activities, including disaster recovery, business continuity, resilience testing and the tracking of actions arising from incidents, audits and assurance reviews.
• Prepare management information, dashboards and reporting on risk, compliance and control performance, building effective relationships with stakeholders, auditors, assessors and suppliers.

• Demonstrable experience in IT controls, IT audit, technology risk, cyber GRC, information security assurance or a related area.
• Practical experience of IT general controls.
• Experience reviewing control evidence and identifying weaknesses.
• Understanding of access, change management and IT operational controls.
• Experience of supplier security assessments, third-party risk or cyber risk.
• Strong analytical skills and attention to detail.
• Clear written communication and the confidence to constructively challenge stakeholders.
• Ability to work independently and manage multiple priorities.

• Experience of IT general controls in a SOX or similar controlled environment.
• CISA, CRISC, CISM, ISO 27001 or another relevant qualification, completed or in progress.
• Experience reviewing SOC 1 or SOC 2 reports.
• Familiarity with NIST CSF, ISO 27001 or COBIT.
• Experience with Microsoft 365, Azure, enterprise SaaS or GRC tooling.

• Work is based at Manchester United's offices, enabling connection and innovation.

• Annual Incentive Scheme to reward dedication and hard work.
• 25 days annual leave (plus bank holidays) and the opportunity to purchase additional holiday days.
• Electric Vehicle scheme via Octopus and cycle to work scheme.
• Health Cash Plan supporting everyday healthcare needs.
• Wellness support with access to mental health resources, digital health checks, and nutritionists through Aviva Digicare+ Workplace.
• Exclusive discounts through the United Rewards platform, giving access to exclusive deals from the club and partners.
• Gym facilities in onsite locations and opportunities for regular social events and team-building activities.
• Enhanced family leave benefits and policies.
• Enhanced career development with access to professional learning platforms such as LinkedIn Learning, and internal training programmes.
• A supportive work environment that values diversity, equity and inclusion, and individual growth.