Senior Technology Risk and Compliance Analyst

About this role

Application Deadline: 2 November 2026

Description

At Manchester United, we believe that excellence on the pitch starts with excellence off the pitch. Our team thrives in a high-performance environment, united by a shared passion for success. We aim to elevate the standard of performance through collaboration and continuous growth, creating a space where everyone can contribute their best to our common goals.

We work together at our iconic Manchester United offices, enabling connection and innovation as we look ahead to what we can achieve as a global football club. We are excited to bring in passionate people who share our vision and drive for success.

Key Responsibilities

The Senior Technology Risk and Compliance Analyst plays a key role in administering the Clubs IT risk and compliance programme, providing hands-on support across IT controls, supplier cyber risk and wider cyber risk management activities.

The role is responsible for coordinating IT SOX compliance, PCI DSS, UK GDPR requirements, third-party assurance and technology change risk processes, including risk assessments, control testing, due diligence reviews, remediation tracking and reporting.

As a senior individual contributor, the postholder will work closely with control owners and stakeholders to review evidence, assess risks, identify control gaps and drive corrective actions to completion, while ensuring accountability for control operation remains with the business.

The role is broadly focused on IT SOX and IT General Controls (40%), supplier cyber risk management (30%) and wider cyber risk support activities (30%), helping to strengthen the organisation’s overall risk and control environment.

• Maintain and develop Manchester United’s IT risk and compliance framework, including IT risk registers, policies, standards, assurance plans and governance reporting.
• Support compliance with IT SOX, PCI DSS, UK GDPR and internal policy requirements by defining controls, coordinating testing, reviewing evidence and tracking remediation activities.
• Conduct risk and compliance assessments for technology projects, system implementations and significant technology changes, ensuring risks are identified, assessed and managed appropriately.
• Lead technology and cyber due diligence activities for suppliers, procurements, contract renewals and service changes, assessing security, privacy, resilience and contractual risks and monitoring remediation actions.
• Identify, assess and monitor technology and cyber risks, maintaining risk registers, supporting governance forums and escalating material risks and control issues where required.
• Coordinate and evaluate IT General Controls (ITGCs), including access management, change management, vulnerability management, backup and recovery, data protection and incident management controls.
• Support internal and external audits, maintain control documentation and contribute to the continuous improvement of risk, control and assurance processes.
• Support operational resilience activities, including disaster recovery, business continuity, resilience testing and the tracking of actions arising from incidents, audits and assurance reviews.
• Prepare management information, dashboards and reporting on risk, compliance and control performance, building effective relationships with stakeholders, auditors, assessors and suppliers.

Skills, Knowledge and Expertise

• Demonstratable experience in IT controls, IT audit, technology risk, cyber GRC, information security assurance or a related area.
• Practical experience of IT general controls, ideally in a SOX or similar controlled environment.
• Experience reviewing control evidence and identifying weaknesses.
• Understanding of access, change management and IT operational controls.
• Experience of supplier security assessments, third-party risk or cyber risk.
• Strong analytical skills and attention to detail.
• Clear written communication and the confidence to constructively challenge stakeholders.
• Ability to work independently and manage multiple priorities.

Desirable

• CISA, CRISC, CISM, ISO 27001 or another relevant qualification, completed or in progress.
• Experience reviewing SOC 1 or SOC 2 reports.
• Familiarity with NIST CSF, ISO 27001 or COBIT.
• Experience with Microsoft 365, Azure, enterprise SaaS or GRC tooling.

What we offer

At Manchester United, we recognise that our people are at the heart of our success. That’s why we offer a range of rewards designed to support your professional and personal well-being:

• Annual Incentive Scheme to reward your dedication and hard work
• *25 days annual leave (plus bank holidays)*and an opportunity to purchase additional holiday days
• Electric Vehicle scheme via Octopus and cycle to work scheme
• *Health Cash Plan:*Supporting you with your everyday healthcare needs
• Wellness Support with access to mental health resources, digital health checks, and & nutritionists through Aviva Digicare+ Workplace
• Exclusive Discounts through our United Rewards platform, giving you access to exclusive deals from the club and partners
• Gym Facilities in our onsite locations and opportunities for regular social events and team-building activities
• Enhanced family Leave Benefits and policies
• Enhanced Career Development with access to professional learning platforms like LinkedIn Learning, and internal training programs
• A Supportive Work Environment that values diversity, equity and inclusion, and individual growth

Manchester United is committed to safeguarding children and vulnerable adults, and as part of this commitment, all candidates will undergo a Disclosure and Barring Service check and reference checks.

If you need any adjustments to help you perform at your best during the recruitment process, please contact us, and we will be happy to discuss them with you.

It is unlawful to employ a person in a UK-based job who does not have permission to live and work in the UK. You should make yourself aware of how immigration laws apply to you before applying for any of our roles.