Global Digital & IT Risk Manager

Global Digital & IT Risk Manager

Derby

Full time

Why join Rolls-Royce?

At Rolls-Royce we are proud to be a business that has truly helped to shape the modern world and are committed to always being a force for progress; powering, protecting, and connecting people everywhere.

By joining Rolls-Royce, you'll have the opportunity to work on world-class solutions, supported by a culture that believes individuality is our greatest strength, and all perspectives, experiences and backgrounds help us innovate and enable our high-performance culture.

Position Summary

An exciting opportunity has arisen for a n Global Digital & IT Risk Manager to join our Digital & IT team in Derby.

The Global Digital & IT Risk Manager is responsible for strengthening the way Digital & IT risks are identified, assessed, prioritised, treated, monitored, and reported across a complex, highly regulated aerospace and defence organisation.

Supporting the VP Digital Risk & Compliance, this role will lead an interactive an engaging risk management process that brings risk conversations to life, challenges assumptions, and helps leaders focus on the risks that matter most. You will work with Digital & IT, cyber security, engineering, business, legal, assurance, and regional stakeholders to translate risk insight into clear ownership, proportionate action, and measurable risk reduction.

The role has a global remit and will help embed a consistent, pragmatic, and forward-looking approach to risk management across different businesses, technologies, jurisdictions, and security environments. It will provide constructive challenge, support informed decision-making, improve the quality and timeliness of risk treatment, and ensure that material Digital & IT risks are clearly understood and escalated through the appropriate governance forums.

What you will be doing:

• Lead the operation and continuous improvement of the Digital & IT risk management framework, ensuring alignment with organisational risk appetite, enterprise risk processes, regulatory obligations, and recognised industry practices.
• Create an interactive and engaging risk process that focuses attention on the risks that matter most.
• Facilitate high-impact risk workshops that encourage open discussion, constructive challenge, and clear decisions.
• Partner with risk and action owners to define practical treatment plans, milestones, target risk positions, and success measures that deliver demonstrable risk reduction.
• Maintain a clear view of the global Digital & IT risk profile, including material exposures, emerging themes, and interdependencies, overdue actions, and areas where exposure may be moving outside agreed appetite or tolerance.
• Produce timely, concise, decision-focused risk reporting, dashboards, heat maps, trend analysis, and executive insights for senior leadership and governance committees, clearly setting out exposure, movement, action, and decisions required.
• Work closely with cyber security, architecture, service management, resilience, data, privacy, compliance, audit, engineering, procurement, and programme teams to integrate risk management into strategic planning, investment, change, supplier, and operational decisions.
• Promote consistent, high-quality risk assessments supported by clear evidence and effective controls.
• Anticipate emerging technology, cyber, geopolitical, supply chain, regulatory, and resilience risks through horizon scanning and scenario analysis.
• Build risk capability and culture through coaching, collaboration, practical guidance, data, automation, and appropriate AI-enabled tools.

Preferred requirements:

• Significant experience in Digital & IT, cyber, technology, operational, or enterprise risk management within a large, global, and highly regulated organisation.
• A strong track record of turning risk management into an engaging, valued business process that improves decisions, creates ownership, drives tangible risk outcomes/ risk reduction.
• Demonstrated ability to facilitate effective risk conversations and workshops with senior leaders, technical specialists, programme teams, and business stakeholders across cultures, functions, and geographies.
• Practical experience of risk identification, assessment, control evaluation, treatment planning, risk acceptance, escalation, monitoring, aggregation, and executive reporting.
• Ability to distinguish material risk from operational noise, connect technology exposure to business outcomes, and provide balanced challenge without unnecessary bureaucracy.
• Strong knowledge of Digital & IT risk, including cyber security, cloud and infrastructure, identity and access, data, resilience, third-party and supply chain, software and product, change, obsolescence, and emerging technology risks.
• Working knowledge of relevant frameworks, including ISO 31000, ISO 27001, NIST, and COBIT.
• Experience using risk appetite, key risk indicators, control effectiveness, scenarios, dashboards, and executive repo

#J-18808-Ljbffr