Group Control Assurance Lead

This is a senior second-line role with a wide mandate: independent control testing across two licensed entities and the full regulatory framework, reporting into the Risk Committee and both Boards, with the latitude to design the programme as you think it should work.

Payhawk operates two electronic money institution licences, one in the UK supervised by the Financial Conduct Authority and one in Lithuania supervised by the Bank of Lithuania. You will cover both, reporting to the Director of Risk and Outsourcing, independent of the teams you review.

You will test whether controls work and whether they would catch what they are designed to catch. This means testing systems rather than case files, and populations rather than hand-picked samples. The role requires someone comfortable with data, confident forming their own view and senior enough to be heard when the answer is unwelcome.

Your mandate covers the whole control framework across both entities: regulatory compliance and conduct, regulatory reporting, financial crime and sanctions, operational resilience and ICT under the Digital Operational Resilience Act, safeguarding, capital adequacy, outsourcing and third-party management, and governance. You will agree risk-based priorities with the Risk Committee each cycle rather than testing everything at once.

You will own the programme end to end and shape how it develops, including the plan, testing, findings, credible challenge to control owners, remediation through to closure and reporting into both Boards. The role involves convening stakeholders, setting clear expectations and dates, keeping work moving, escalating where it stalls, securing approvals and independently validating that fixes hold before findings are closed.

Payhawk builds control functions using automation. You will use AI as a working tool by pulling data from connected systems, prompting effectively to obtain reliable answers from large document sets and turning tests into repeatable workflows that produce their own evidence. Payhawk will provide the tooling, data access and mandate to build the programme around it, with recurring manual checks to be automated where possible.

Responsibilities include:

• Build and own the Board-approved group control assurance and monitoring plan covering both licensed entities, with priorities set by the risk assessment and agreed with the Risk Committee. • Design and run risk-based control testing across the group risk register, assessing design effectiveness and operating effectiveness. • Test operational resilience and ICT controls under the Digital Operational Resilience Act, as well as governance and conduct controls across both entities. • Test safeguarding and capital adequacy controls, including whether reconciliations and calculations evidence what they are relied on to evidence. • Test regulatory reporting controls, including the completeness and accuracy of the data behind regulatory returns. • Test outsourcing and third-party controls, including whether a critical provider falling below its obligations would be detected. • Independently test detection controls end to end, including sanctions and politically exposed person screening effectiveness, transaction monitoring coverage and calibration, and the population that never generated an alert. • Lead remediation of identified gaps, acting as programme manager for closure by convening stakeholders, agreeing scope, owners and dates, tracking progress, escalating where work stalls and securing governance approvals. • Independently validate that remediated controls work before findings are closed, and reopen findings where fixes do not hold. • Provide credible challenge to control owners through written findings, severity ratings, agreed actions and owners. • Report testing results, remediation status, coverage against plan and thematic findings to the Risk Committee and the Boards of both entities. • Own relationships with external assurance providers and progressively bring recurring testing in-house to reduce cost and dependency. • Build automated, repeatable, population-level testing that generates its own evidence rather than relying on one-off manual exercises. • Support supervisory engagement and internal audit by producing evidence of control effectiveness on demand. • Provide independent assurance over significant change so that new systems and processes are tested before becoming business as usual.

Requirements include genuine fluency with AI in day-to-day work; the ability to pull data and reports from connected systems, obtain reliable answers from large document sets and datasets, and build repeatable workflows; and evidence of having built a workflow, set of prompts, report or small automation that saved real time.

You should have compliance monitoring, control testing or assurance experience across a regulated framework in a second-line or third-line capacity, covering more than one risk domain. You should have strong knowledge of Financial Conduct Authority expectations on the compliance function and its monitoring programme, and equivalent EEA expectations; real depth in at least two relevant risk domains; the ability to distinguish control design from control execution and test a system rather than a case file; and a track record of driving remediation to closure.

You should be comfortable working with data at population level, demonstrate independence and the ability to challenge senior control owners, produce Board-standard written English and rate findings proportionately. Fluent written and spoken English and the right to work in the United Kingdom are required.

Nice-to-have experience includes a Big Four or specialist consultancy assurance, audit or regulatory advisory background; experience in payments, e-money or banking; exposure to operational resilience and ICT risk, safeguarding, capital adequacy or regulatory reporting; experience testing screening or transaction monitoring effectiveness; SQL, Python or similar and practical use of data testing frameworks; a relevant qualification such as IIA, ICA or ACAMS; and experience of a multi-entity or multi-jurisdiction group structure and intragroup outsourcing oversight.

Benefits include 30 days of paid time off plus 12 work-from-anywhere days, an exchange policy with Payhawk offices in Amsterdam, Paris, Barcelona, Berlin and Sofia, health and fitness membership, two company off-sites per year, and use of the Payhawk product with a monthly commuting allowance of £150.