Senior Associate, Technology Risk & Resilience (Cloud)

About the role

PwC's Technology Risk and Resilience team helps firms navigate a fast-moving regulatory landscape while managing robust, future-proof technology estates. The team shapes digital resilience frameworks under the Digital Operational Resilience Act (DORA) and helps firms improve their technology risk maturity. This Senior Associate position sits within the Internal Firm Services line of service.

Key responsibilities

• Support the engagement manager and the wider team in delivering technology risk and resilience advisory engagements.
• Perform control walkthroughs, sample testing and evidence review across technology risk and resilience domains.
• Draft gap analysis and maturity assessment artefacts aligned to frameworks such as COBIT, ITIL, NIST CSF and ISO 27001/22301.
• Assist with regulatory readiness and assurance projects, including resilience assessments under DORA and other EU/UK regulations.
• Prepare working papers and contribute to reports for clients, regulators and internal stakeholders.
• Use platforms such as ServiceNow for resilience-related analysis and reporting, and leverage AI tools for risk monitoring and resilience testing.
• Contribute to cloud and DevOps risk assessments, and assist with tender responses and proposal documents.
• Build relationships with client SMEs and control owners, coach junior team members and take ownership of your own development.

Required profile

• Experience in technology risk, IT audit, digital resilience or related consulting.
• Working knowledge of UK/EU technology and resilience regulations (including DORA) and frameworks such as COBIT, ITIL, NIST CSF and ISO 27001/22301.
• Practical experience in control testing or assurance fieldwork (sampling, walkthroughs, KRI analysis).
• Strong communication skills, able to turn technical findings into clear messages for business stakeholders.
• Experience using AI in current work for risk and resilience use cases.
• Progress toward professional certifications such as CRISC, CISA, CISSP, CBCI, ISO 22301 Lead Auditor or Prince2/AgilePM.
• Exposure to regulatory remediation programmes (e.g. s166 Skilled-Person reviews) preferred.

Required skills

• Familiarity with ServiceNow for resilience analysis and automation.
• Understanding of technology risk models and resilience frameworks.
• Preferred: exposure to regulatory remediation programmes.