Head of IT Operations and Risk

Role Title: Head of IT Operations Risk Role Description: The Head of IT Operations Risk is a senior leadership role with two connected remits: driving technology risk management across Instem’s technology functions, and leadership of the IT Operations function — Infrastructure and Technical Support — through its senior staff. The core driver for the role is technology risk management. Instem maintains a Technology Risk Library, a Control Library, and a register of Risk Issues. This role keeps that landscape clean across Instem’s technology functions: prompting and collecting risk information from the VP Corporate IT Security, the Infrastructure and Technical Support functions, the Corporate Security practice, and peer technology functions; identifying and driving Risk Issues to resolution; and owning its own function’s response to corrective actions raised through GRC. The role participates in collaborative IT Security Risk Committee (ITSRC) reporting and discussion, and is trusted to represent the technology risk posture to that forum. Its authority rests on ownership of the risk process rather than on line management: the role can require a risk answer, log and chase a Risk Issue, and report posture for any technology function — whether the holder of that risk is a direct report, a peer, or a VP in another function. Accountability for whether a specific control is adopted remains with the function that owns it. The operational remit is exercised through others. The role provides leadership and direction to the Senior Technical Support Analysts, who own day-to-day service delivery, SLA performance, and stakeholder relationships, and provides line management to the Infrastructure function, whose technical direction and engineering standards sit with the function’s senior engineer. Running the desk sits with the Senior Technical Support Analysts: escalations handled, tickets meeting SLA, and the operational drive to make things happen. The Head of IT Operations Risk sets strategy and direction and keeps the ship steady without interfering in the work: accountable for the health of the operating model — capability, coverage, succession, and governance — while stepping in alongside its senior staff for the most difficult escalations, stakeholder conversations, and internal customer reviews. The role builds relationships that enable, coaches to get the function’s goals met rather than defaulting to doing, and acts as a safety net — not a substitute — for its reports. It requires someone who understands the balance between IT operations, user experience, and risk, not a hands-on engineer. Success in this role is measured in team capability, control effectiveness, and demonstrable risk reduction — not in personal operational involvement. Tasks associated with the Role: Technology Risk Governance: • Maintain the technology risk view of the Technology Risk Library and Control Library in partnership with the VP, spanning Corporate IT operations and the wider technology functions: risks and controls clearly evidenced, proportionately rated, and reviewed on a defined cadence. IT operations is a material area of the risk programme, not the whole of it. • Own the identification and management of Risk Issues across the technology functions — where no mitigating control exists, or where a control has failed — and drive them to resolution with the function that owns the risk. • Own the function’s response to corrective actions: know the audit findings and the target state, manage the GRC-to-team relationship, and ensure responses reflect genuine capacity and reality. Surface management findings ahead of GRC audits to improve audit outcomes, and maintain an open and honest relationship with GRC, which owns the corrective action register and provides independent assurance. • Identify emerging technology risks proactively from operational patterns, infrastructure change, vendor behaviour, and incident trends; prompt and collect risk information from the VP, the Infrastructure and Technical Support functions, the Security practice, and peer technology functions to keep the technology risk landscape clean. • Participate in collaborative ITSRC reporting: own the operational detail and risk narrative for the technology risk picture, translating operational data into a risk posture that decision-makers can act on. • Assess the effectiveness of IT Operations-managed ISO27001 controls and lead their presentation at external audit; operational evidence is produced and maintained within the Infrastructure and Technical Support functions. • Own the design, cadence, and governance of the system access review process, with technical execution performed by the Infrastructure and Technical Support functions. • Own change governance from a risk and approval stance: ensure changes are well considered, proportionately approved, and that the team has the capacity to deliver and respond. The approval test at this level is risk, proportionality, and capacity — not technical merit, which sits with the function’s senior engineer and the Security practice lead. This role typically does not submit, design, or implement changes. • Hold risk owners to account on control adoption and embedding across the technology functions, whether they are direct reports, peers, or VPs in another function; build the relationships that make enforcement rarely necessary and manage crossed boundaries constructively. Where a function declines to act, the role logs the Risk Issue and reports it — accountability for adopting a specific control remains with the function that owns it. Technical Support Operations Leadership (through the function’s senior staff): • Provide leadership and direction to the Senior Technical Support Analysts, whose remit includes day-to-day service delivery, SLA ownership, escalation resolution, and stakeholder management. This ownership sits permanently at Senior Technical Support Analyst level; what grows with grade is the confidence and capability with which it is exercised, not the boundary of the remit. • Chair the operational rhythm: receive and challenge service performance, trend, and capacity reporting produced by the Senior Technical Support Analysts; own escalation governance. • Own the ITSM platform’s fit to business need and its direction as the routing backbone for IT and, where valuable, non-IT functions, and own the governance that keeps it serving the process rather than the other way round. Platform configuration, development, automation, and day-to-day administration sit with the Senior Technical Support Analysts. • Own incident and problem management at a strategic level: ensure major incidents are handled well, root causes are genuinely addressed, and lessons are embedded. • Step in alongside the Senior Technical Support Analysts for the most difficult escalations, stakeholder conversations, and internal customer reviews — as support and safety net, without displacing their ownership of resolution. • Manage the function’s relationship with VP-layer business stakeholders; chair periodic service reviews, with Senior Technical Support Analysts presenting, and ensure the quality of service is honestly communicated and improving. Infrastructure Operations Management (through the function’s senior staff): • Provide line management, coaching, and professional development to the Infrastructure Engineers; all technical direction, architecture, and engineering standards for the infrastructure estate sit with the function’s senior engineer, and this role is responsible for ensuring their capacity to build and deliver. • Ensure the infrastructure function is resourced, prioritised, and aligned to business and risk priorities. • Set the infrastructure function’s priorities and direct where its engineering capacity goes: which automation is built next, which operational burdens are engineered away, and when. • Ensure infrastructure engineering measurably serves the Technical Support service: self-service tooling shipped, recurring request classes eliminated, and burdens surfaced by the Senior Technical Support Analysts engineered away rather than queued indefinitely. • Create the conditions for technical capability to develop under strong mentorship, ensuring the function’s senior engineer teaches and delegates across the function rather than simply doing — an expected standard, not a bonus. • Balance end-user experience, engineering capacity, and security practice, working in partnership with the Security practice lead. Capability Building People Development: • Coach the Senior Technical Support Analysts to exercise their ownership with genuine autonomy: SLA ownership, decision-making, and stakeholder management sit with them permanently, and the coaching is aimed at how well that ownership is held, not whether it transfers. • Develop the infrastructure function’s senior engineer as a technical leader — capable of delegating, teaching, and raising capability across the Corporate IT function, not just delivering. • Treat capability and succession gaps as operational risks: identify them, log them, and close them deliberately through coaching, structured development, or targeted hiring. • Build Senior Technical Support Analysts capable of full deputy cover on tactical technical support and service decisions. • Foster a culture of ownership: problems raised early, resolved independently where possible, and escalated with a recommendation rather than a question. Strategic Partnership with the VP: • Act as a thought partner to the VP Corporate IT Security on operations strategy, risk posture, and organisational development. • Contribute the technology risk and IT operations sections to ITSRC materials, governance documentation, and board-level reporting; own those sections end-to-end. • Support the VP in managing IT-related organisational change: vendor transitions and capability investments. • Stay current on IT operations practice, risk management frameworks, and relevant regulatory developments. Vendor Supplier Oversight: • Maintain strategic oversight of key IT service vendors and managed service relationships; ensure contracts are performing and escalate where they are not. • Support vendor risk assessment where suppliers introduce operational or information security exposure. • Day-to-day vendor contact sits with the Vendor Administration function and the Senior Technical Support Analysts; accountability for vendor relationship health at a strategic level sits here. Governance, Quality Compliance: • Adherence to the Company’s Quality Management System to ensure that all work is handled Securely, Professionally and Diligently. Behavioural Competencies: • Operates above the noise — identifies systemic issues and addresses them at the root rather than absorbing the symptoms • Risk-conscious by instinct — surfaces problems early, documents them clearly, and drives resolution without being prompted • Builds capability, not dependency — measures success by how well the function performs without direct involvement • Coach and safety net, not rescuer — steps in to support when things get difficult, without taking over work that belongs to others • Speaks plainly to senior leadership — honest about current state, comfortable delivering difficult news • Calm under pressure — brings considered judgement where others bring urgency • Pragmatic and proportionate — applies genuine judgement to prioritisation • Earns trust through reliability — surprises are rare and communicated early • Outcome-focused — measures success in team performance and risk reduction, not activity • Collaborative across functions — works naturally with Security, Infrastructure, Platform Engineering, GRC, and business stakeholders Skills, Knowledge and Experience: Expected: • Practical experience delivering a structured information risk or assurance programme in partnership with senior leadership (e.g. ISO 27001 or equivalent), including risk identification, remediation tracking, and audit evidence. Must include experience holding risk owners outside their own line to account — peers or more senior stakeholders — on the strength of the risk process rather than positional authority. • Track record of owning incident and problem management practice — root cause analysis governance, post-incident review, and lessons-learned culture — with specific evidenced examples; process ownership rather than hands-on incident response. • Working knowledge of ISO 27001 or equivalent information risk frameworks, with a clear understanding of the difference between compliance and genuine control effectiveness. • Demonstrable experience leading IT operations or service functions with a track record of building team capability rather than managing from the middle. • Experience shaping off-the-shelf ITSM products to fit business need, with proven ability to embed other technical or non-IT functions into ITSM and service routing. • Demonstrable coaching track record: has developed leads or managers who operate with genuine autonomy, and can articulate specific examples. • Confident communicator at senior and executive level — able to translate operational complexity into risk and performance narratives. • Comfortable operating without deep technical hands-on capability: defers to engineers on technical matters, asks precise questions, and makes good decisions on the basis of evidence. • Experience managing vendor and service provider relationships at a governance level. • Ability to write clearly: risk registers, operational reports, and stakeholder communications produced to a standard that requires minimal rework. Desirable: • Experience in a multi-region IT operations environment, particularly with UK, US, India, and European coverage. • Experience contributing to board-level or executive risk reporting, including ITSRC or equivalent governance forums. • Background in or exposure to ISO 27001 or similar programme audit preparation and evidence management. • Familiarity with ITSM tooling (Halo, ServiceNow, or equivalent) at an operational oversight level. • Exposure to ITIL at a process ownership level; certification not required, genuine process knowledge is. • Knowledge of the company’s Quality Management System and its application to IT operations and risk activities.