Sr. Manager, Information Risk & Controls

About Invesco

As one of the world’s leading independent global investment firms, Invesco is dedicated to rethinking possibilities for our clients. By delivering the combined power of our distinctive investment management capabilities, we provide a wide range of investment strategies and vehicles to our clients around the world. If you're looking for challenging work, intelligent colleagues, and exposure across a global footprint, come explore your potential at Invesco.

About the Department/Team:

At Invesco, we value focusing on clients, purposeful interactions, and teamwork. Within Enterprise Risk, you can expect to draw from your existing skills to drive value while finding opportunities to expand your talent and career.

Invesco Enterprise Risk Management (ERM) is evolving its capabilities and is looking for new Team members. Enterprise Risk is a global Second Line of Defense function that engages with Invesco Business teams to facilitate delivery and oversight of the risk management framework and provide a consistent, aligned approach to risk management across the firm.

The Enterprise Risk Management team, comprised of dynamic, diverse, and highly collaborative members, drives value to Invesco by delivering a comprehensive and standardized view of risk, integrated and underpinned by data and metrics. At the heart of the Invesco Enterprise Risk framework is the foundation for strong analytics, capable of responding to emerging threats and opportunities and adapting to evolving market trends and conditions.

Whether you want to extend your existing experience to Enterprise Risk or leverage Risk Management expertise to evolve Invesco’s Enterprise Risk Management capability, we’ve got exciting opportunities.

About the Role:

Invesco is adopting new technologies, strengthening its data strategy, expanding its use of third parties and evolving its operating model to serve clients better. These changes raise the importance of two risk domains in particular: Business Resilience and Data Governance. The Sr. Manager of Information Risk and Controls is the second-line lead for these two domains. Supporting the Global Head of Information Risk and Controls, this individual provides independent oversight and challenge of how the first line identifies, assesses, controls, reports and responds to resilience and data risk, and turns that oversight into clear findings, appetite positions and escalations for senior risk committees. The role works day to day with the Chief Data Office, the Business Resilience and Incident& Crisis management functions, Compliance and Internal Audit, and coordinates with cybersecurity, privacy, technology risk and operational risk specialists, business users, architects and other subject matter experts where a risk crosses functional boundaries. Partnering with a team of subject matter experts, a key strategic focus will be to strengthen the overall risk posture, enhance risk management measures and support independent governance that let the firm evidence its resilience and data risk posture to its management and regulators.

Responsibilities of the Role:

• Business Resilience oversight: Lead second-line oversight of Business Resilience across the firm, including its regulatory operational resilience obligations. Challenge the design and effectiveness of resilience capabilities, recovery arrangements, testing and remediation, and escalate exposures that remain outside appetite.

• Data Governance oversight: Lead second-line oversight of data risk. Challenge the effectiveness of the firm’s data governance framework, its adoption across the business and the progress of remediation and oversee data risks arising from new technology and AI use in coordination with privacy, cybersecurity and model risk specialists and with the business users, architects and other subject matter experts closest to that use.

• Incident & Crisis management Advisory: Review material incidents affecting resilience or data for root cause, control failure and adequacy of response; advise the first line and senior management on lessons learned and remediation; provide independent second-line commentary to management and risk committees; and contribute to the continuing improvement of the firm’s incident & crisis management practices.

• Risk Management Activities: Lead the second-line role in the annual risk and control self-assessment for both domains and produce the rating recommendation for committee. Oversee the risk appetite measures and enhance key risk indicators for both domains, challenging coverage, thresholds and escalation.

• Risk Reporting & Governance: Provide independent review of Business Resilience and Data risk reporting before risk committee submission, present a clear second-line opinion, and challenge risk acceptances, policy exceptions and issue remediation timelines that materially affect either domain.

• Policy, regulatory and industry engagement: Lead the development and periodic review of ERM policies, standards, taxonomy and reporting guidance for the two domains, ensuring appropriate risk oversight and reporting against regional regulatory requirements. Support regulatory engagement on resilience and data governance matters, including examinations and information requests. Engage with industry networks and peers to track developments in resilience and data risk management and bring relevant practice back to the firm.

• Leadership and collaboration: Provide strategic leadership to the analysts supporting both domains, setting priorities, developing capability and remaining accountable for the quality of second-line conclusions. Partner with first-line risk owners, the Chief Data Office, Business Resilience, Compliance and Internal Audit, and with the wider operational & enterprise risk management community, so that oversight of the two domains is coordinated across the three lines and the firm’s risk culture in these areas is strengthened

Requirements for the Role:

• Risk management experience: Typically 8 or more years of relevant risk, control, data governance or assurance experience, including substantial experience in either operational resilience or data governance with demonstrated working capability in the other, gained within or advising regulated financial services institutions. Asset management experience is preferred.

• Business resilience expertise: Demonstrated experience applying operational resilience and business continuity requirements in a regulated environment, including familiarity with current regulatory resilience regimes.

• Data governance expertise: Demonstrated experience assessing or implementing data governance operating models, including accountability, stewardship, classification, data quality, lineage and critical data. Familiarity with recognized data governance or risk data aggregation principles is desirable.

• Incident management experience: Experience reviewing significant incidents, assessing root cause and control failure, and advising on remediation and lessons learned.

• Second-line assessment experience: Experience independently challenging risk and control self-assessments and remediation evidence, and designing or challenging key risk indicators and their thresholds.

• Committee and regulatory reporting: Experience preparing, reviewing and defending risk reporting for senior committees and forming a clear second-line opinion. Experience supporting regulatory examinations or information requests is desirable.

• Communication and influence: Communicates material findings clearly to senior stakeholders, supports conclusions with evidence and secures accountable management responses; provides independent, constructive challenge and proportionate escalation while maintaining effective working relationships.

• Analytical ability: Root-cause thinking on control failures and remediation, distinguishing symptom closure from remediation; comfortable using risk management platforms and analytical tools to assess complex information.

• Leadership: Experience directing or coaching risk professionals, setting priorities and maintaining the quality of team conclusions.

• Emerging technology: Can assess how cloud dependencies, automation and AI-enabled data use affect resilience, data quality, accountability and control effectiveness.

• Education: An undergraduate degree is required; an MBA or master’s degree in a relevant field is preferred.

• Professional qualifications: A relevant professional qualification in resilience, risk, audit or data governance is desirable (for example CBCI/MBCI, CRISC, CISA, CDMP, CISM).

Full Time / Part Time

Full time

Worker Type

Employee

Job Exempt (Yes / No)

Yes

Workplace Model

Pursuant to Invesco’s Workplace Policy, employees are expected to comply with the firm’s most current workplace model, which as of October 1, 2025, includes spending at least four full days each week working in an Invesco office. This reflects our belief that spending time together in the office helps us build stronger relationships, collaborate more easily, and support each other’s growth and development.

The above information on this description has been designed to indicate the general nature and level of work performed by employees within this role. It is not designed to contain or be interpreted as a comprehensive inventory of all duties, responsibilities and qualifications required of employees assigned to this job. The job holder may be required to perform other duties as deemed appropriate by their manager from time to time.

Invesco's culture of inclusivity and its commitment to diversity in the workplace are demonstrated through our people practices. We are proud to be an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, creed, color, religion, sex, gender, gender identity, sexual orientation, marital status, national origin, citizenship status, disability, age, or veteran status. Our equal opportunity employment efforts comply with all applicable U.S. state and federal laws governing non-discrimination in employment.