Risk & Control Officer

You’ll report to our Head of Risk and Control and work closely with First Line teams across the business. Our Risk & Control team is highly collaborative and dedicated to driving a culture of sound risk management across Pleo. You’ll also have the chance to partner with teams across Product, Operations, Finance, and Compliance to ensure cross-functional success.

As a Risk & Controls Officer , you will:

Support Risk Framework Execution – Contribute to the implementation and maintenance of Pleo's 2LOD risk management framework, ensuring controls remain aligned with regulatory expectations and business strategy.

Execute Oversight Activities – Conduct RCSAs (Risk and Control Self Assessments) and control reviews across the business. Assess the quality of risk identification and control design, and challenge 1LOD findings where appropriate.

Identify & Assess Risks – Support scenario analysis and stress-testing exercises across operational, technology, product, and credit risk domains. Help surface emerging risk exposures to leadership.

Be a Reliable Risk Advisor – Support business teams with guidance on risk topics, control requirements, and regulatory change, providing practical recommendations on risk and control issues.

Support Risk Reporting & Regulatory Engagement – Contribute to the preparation of clear, data-informed risk reports for senior management and governance committees, and assist with regulator interactions on risk and control matters.

To put things into context, we currently have scaling our 2LOD oversight framework and enhancing cross-functional RCSA processes on our roadmap. You can expect to work with modern risk management platforms, GRC tools, and data analytics dashboards.

You’ll thrive in this role if you have:

Financial Services Experience – 3+ years of experience in a regulated financial services environment (FinTech, banking, payments, or similar) with hands-on experience in risk or control management.

Essential Credit Risk Expertise – A solid, demonstrated understanding of the assessment and management of credit risk.

Core Risk Domain Knowledge – Proven experience with operational risk, technology risk, and product risk assessment.

Hands-On Risk & Control Execution – Background in ERM framework execution, control design, RCSAs, assurance activities, and remediation tracking.

Clear & Collaborative Communication – Ability to translate complex risk concepts into practical, accessible language for diverse audiences, from frontline teams to leadership.

Pragmatic, Solutions-Oriented Approach – A real-world problem-solving mindset that delivers workable answers to real risk challenges rather than defaulting to theoretical frameworks alone.

This role is a good fit for you if:

You want to actively shape 2LOD risk maturity in a high-growth FinTech scale-up.

You enjoy a pragmatic, hands-on role where risk oversight directly enables business growth and innovation.

You thrive in a collaborative environment partnering with cross-functional teams across Product, Operations, and Finance.

This role is not a good fit for you if:

Your background is primarily in traditional Internal Audit, Consulting, or pure Compliance without direct operational risk framework and RCSA experience.

You prefer operating strictly within rigid, theoretical risk models without adapting to fast-paced commercial realities.

You prefer purely administrative risk logging over proactive challenge, advisory, and stakeholder collaboration.

In your first 12 months at Pleo, you’ll:

Get under the skin of Pleo's risk landscape and take ownership of key 2LOD review, RCSA, and challenge activities across priority business areas.

Play an active role in evolving our risk framework as the company continues to scale — contributing your expertise to initiatives that shape how we manage risk for years to come.

Build strong cross-functional relationships , establishing yourself as a credible, trusted advisor on risk and control matters.

We’re committed to helping you develop your career, whether that means deepening your technical subject matter expertise, expanding your regulatory exposure, or stepping into broader leadership responsibilities within the Risk team.

We want to ensure you are set-up for success and understand what will be expected of you. If your application is successful, our interview process is as follows:

Intro call: A 30-minute chat with our Talent Partner to discuss the role and your background.

Hiring Manager: A 45-minute chat with our Head of Risk & Control.

Peer Interview: A 60-minute chat with your peers and / or senior stakeholders.

Final Interview: A 30-minute chat with our SVP Risk & Compliance.

Transparency is important to us so we also wanted to share some insights about what we’re looking for in applications to ensure you can set yourself up for success!

Last time we hired a Risk & Controls Officer, we received a high volume of applications, but only a selective group were invited to an intro call. Some of the key reasons why previous candidates didn’t make it past the application screening stage include:

CV writing and content: We receive a lot of CVs, and many of them are AI-generated. We love seeing people leverage AI—it’s a big focus for us internally too—but without human intervention, these CVs can sometimes become generic and fail to show a candidate in the best light. What we're really looking for is the specific details of real impact that only you know from your previous experience. A top tip from us is to use the “Achieved X, as measured by Y, by doing Z” formula to give a really clear picture of what you’ve worked on. Including links to your previous companies' websites is also a huge help!

Application care: Every single application we receive is reviewed by a human because we believe that candidates' efforts should be matched by an equal level of human care. Read and answer the application questions carefully, as they make a huge difference in our decision-making process.

Profile to role fit: For this role specifically, candidates whose backgrounds focus exclusively on professional consultancy, compliance reporting, or internal audit without hands-on 2LOD risk framework, credit risk, and RCSA execution experience often do not meet our core requirements.