Head of Technology Risk & Controls

Release Management

• Establish and maintain clear, real-time visibility of all changes taking place across the Client Connectivity estate, ensuring nothing goes untracked or ungoverned
• Own the risk assessment framework for changes, ensuring every release is evaluated consistently and that risk is understood and accepted before deployment to production
• Work with delivery teams to drive up release cadence by encouraging smaller, safer, low-risk, non-breaking changes — moving away from large, infrequent releases towards a more controlled and continuous flow of change
• Champion engineering practices that make frequent releases achievable — including feature flags, backward-compatible changes, and robust automated testing — in partnership with engineering leads
• Track and report on release quality metrics, including change-related incidents, rollback rates, and post-implementation review outcomes
• Act as the escalation point for release-related risk decisions, providing clear guidance to teams on when changes are ready to proceed and when they are not

Engineering Lens & AI-Driven Efficiency

• INTERNAL
• Apply an engineering mindset across all four Control Centre disciplines, challenging manual and repetitive processes and seeking opportunities to automate, streamline, and simplify
• Identify and prioritise use cases where AI and machine learning tooling can meaningfully reduce effort, improve accuracy, or enhance the speed of decision-making within risk, resilience, cyber, and release management
• Work with engineering and data teams to prototype, test, and embed AI-driven tooling into Control Centre workflows
• Establish a continuous improvement culture within the team, where efficiency opportunities are regularly surfaced and acted upon
• Ensure that automation and AI adoption is done responsibly — with appropriate controls, auditability, and governance in place
• Track and report on efficiency gains delivered through engineering and AI initiatives, demonstrating measurable impact over time

Essential Skills & Experience

• Empathy with the software engineering discipline.
• Significant experience in a senior technology risk, control, or operational resilience role within financial services
• Strong understanding of risk and control frameworks, with proven experience designing and implementing them at scale
• Demonstrable experience across two or more of: cyber/fraud, release management, or operational resilience
• Appetite and ability to apply an engineering lens to operational problems — comfortable working with engineers and data teams to identify and deliver automation and AI-driven improvements
• Track record of leading and motivating cross-functional teams, ideally within a large, matrixed organisation
• Excellent stakeholder management skills, with the ability to engage credibly at senior and executive level
• Strong analytical and problem-solving skills, with the ability to make decisions in ambiguous or complex environments
• Experience managing regulatory relationships and preparing material for governance forums

Desirable

• Experience in investment banking or financial markets technology
• Familiarity with HSBC's risk and control framework, operational resilience standards, or technology governance processes
• Knowledge of relevant regulatory requirements (e.g. DORA, PRA operational resilience policy, FCA expectations)
• Industry certifications such as CISM, CRISC, ITIL, or equivalent

Leadership & Behaviours

The Successful Candidate Will Demonstrate The Following Behaviours

• Collaborative — builds strong relationships across the department and broader organisation to drive shared outcomes
• Decisive — comfortable making sound judgements with imperfect information and taking accountability for decisions
• Inclusive — creates an environment where all team members can contribute, develop, and thrive
• Forward-thinking — anticipates risks and opportunities before they materialise, rather than simply reacting to events
• Clear communicator — able to translate complex risk and technical concepts into clear, actionable language for all audiences

What Success Looks Like

In the first six months, the Head of Control Centre will be expected to:

• Have mapped all Control Centre-related activity and personnel across Client Connectivity
• Have established a clear target operating model for the Control Centre function
• Have begun the process of aligning the team around common standards, processes, and ways of working
• Have built strong relationships with key stakeholders across the department and with second-line functions
• Have delivered an initial assessment of the department's risk and control posture

In the first twelve months, the Head of Control Centre will be expected to:

• Have a fully operational and cohesive Control Centre function in place
• Have eliminated material duplication of effort across the five Control Centre disciplines
• Have implemented consistent, documented processes and controls across all areas of remit
• Have identified and begun delivering a pipeline of AI and automation opportunities across the Control Centre remit
• Have achieved measurable improvements in the department's risk profile and resilience posture
• Have established the Control Centre as a trusted and valued partner across Client Connectivity