IT Risk and Control Manager, Galaxy

• Minimum 10 years’ experience in IT risk, cybersecurity governance, or technology audit in financial services or crypto/digital assets
• Strong knowledge of UK, EU, and US cybersecurity regulatory requirements, including MiCA, DORA, GDPR, and relevant FCA rules
• Demonstrated success leading risk assessments and compliance audits
• Experience with IT GRC tools (e.g., Archer, ServiceNow, OneTrust)
• Strong analytical, communication, and stakeholder management skills

Desirable

• We are seeking a highly experienced IT Risk and Control Manager to join our London-based team
• This role will lead the execution of IT risk management and control governance activities across our UK operations, support regulatory compliance under UK, EU, and US cybersecurity requirements, and oversee third-party ICT risk due diligence
• The role is critical in ensuring Galaxy Digital’s continued compliance as a regulated Virtual Asset Service Provider (VASP)
• Control Governance:
• Monitor and test IT controls for effectiveness, report deficiencies, and oversee remediation plans
• Maintain oversight of internal audit findings and risk action plans
• Ensure all UK operations align with group-wide IT governance standards and policies
• Regulatory Compliance:
• Ensure adherence to UK and EU laws and regulations including:
• UK NIS Regulations, PRA SS1/21, FCA SYSC
• EU DORA, MiCA
• US NIST CSF, NYDFS, SEC cybersecurity rules (where applicable)
• Support regulatory submissions and requests from UK authorities (FCA, ICO, NCSC)
• Partner with Compliance to assess the impact of emerging cyber regulations on UK operations
• Third-Party Risk Management:
• Execute third-party cybersecurity risk assessments and onboarding due diligence
• Work with procurement and legal to enforce ICT contractual requirements (e.g., exit plans, audit rights, data security SLAs)
• Maintain the third-party risk inventory and ensure periodic reviews
• Policy and Awareness:
• Maintain IT and cyber policies in line with industry and regulatory expectations
• Lead awareness initiatives for secure technology practices and incident response preparedness