SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Payhawk is a global spend management platform serving scaling businesses across 32 countries. This is a senior second-line control assurance role with a broad mandate covering independent control testing across two licensed entities (UK FCA-regulated and Lithuania Bank of Lithuania-regulated electronic money institutions). You will report to the Director of Risk and Outsourcing, with direct reporting lines to the Risk Committee and both Boards.
The core responsibility is designing and executing a risk-based control assurance programme that tests whether controls actually work as intended. This means testing systems and populations rather than hand-picked samples, using data-driven approaches to validate control effectiveness across the full regulatory framework. You will assess both design and operating effectiveness of controls across regulatory compliance, conduct, financial crime and sanctions, operational resilience and ICT (Digital Operational Resilience Act), safeguarding, capital adequacy, outsourcing and third-party management, and governance.
You own the programme end-to-end: developing the annual plan in collaboration with the Risk Committee, executing testing, identifying gaps, challenging control owners on findings, managing remediation through closure, and reporting outcomes to both Boards. This role is as much programme management as technical testing—convening stakeholders, setting expectations, escalating blockers, and validating that fixes hold before closure.
A key differentiator is the expectation to work fluently with AI and automation tools. Rather than manual sample testing, you will pull data from connected systems, use AI to analyse large document sets reliably, and build repeatable tests that generate their own evidence. You will have the tooling, data access, and mandate to automate recurring manual checks.
This is a role for someone comfortable with data and quantitative analysis, confident forming independent views on control effectiveness, and senior enough to deliver credible challenge when findings are unwelcome. You will work across two regulatory jurisdictions and multiple business domains, requiring strong stakeholder management and the ability to prioritise a broad mandate.
