Operational Risk Manager

The Senior Manager: Non-Financial Risk is responsible for supporting the Chief Risk Officer in establishing, implementing, enhancing and overseeing the Bank's Non-Financial Risk Management Framework.

The role serves as a key member of the Enterprise Risk Management function and provides independent second-line oversight, challenge and strategic guidance across operational and non-financial risk disciplines, including Operational Risk, Operational Resilience, Business Continuity Management, Third-Party Risk, Information Security Risk, Information and Communication Technology (ICT) Risk, Digital Fraud Risk and other emerging risks.

The incumbent will work closely with business management, control functions and specialist risk teams to ensure that non-financial risks are effectively identified, assessed, monitored, managed and reported, while supporting the Bank's strategic objectives, operational resilience and regulatory obligations.

The role will also assist the CRO in providing senior management, Board committees and regulators with a comprehensive view of the Bank's non-financial risk profile and the effectiveness of related risk management practices.

Requirements

Non-Financial Risk Strategy and Governance

• Support the CRO in developing and maintaining the Bank's Non-Financial Risk Management Framework, policies, standards and methodologies.
  
• Drive the continuous enhancement of the Bank's non-financial risk management capabilities and maturity.
  
• Assist in the development and monitoring of risk appetite statements, tolerance levels, key risk indicators and governance reporting.
  
• Monitor emerging regulatory requirements, industry developments and evolving risk trends.
  
• Provide strategic advice and independent challenge to management regarding significant non-financial risk exposures and control weaknesses.
  
• Support the preparation of risk management papers and presentations for Executive Management, Board Committees and regulators.
  

Operational Risk Management

• Oversee the implementation and ongoing effectiveness of the Operational Risk Management Framework.
  
• Coordinate and challenge Risk and Control Self-Assessments (RCSA), risk assessments and control effectiveness reviews across the Bank.
  
• Oversee operational risk event and incident management processes, including root-cause analysis, lessons learned and remediation tracking.
  
• Monitor operational loss events, risk trends and control weaknesses and ensure material issues are appropriately escalated.
  
• Facilitate the development and monitoring of operational risk indicators and early warning metrics.
  
• Provide independent review and challenge regarding risk treatment plans and risk acceptance decisions.
  

Operational Resilience and Business Continuity

• Support the design, implementation and continuous enhancement of the Bank's Operational Resilience Framework.
  
• Lead the Bank's Business Continuity Management programme, including business impact assessments, continuity planning, testing and recovery exercises.
  
• Coordinate resilience assessments covering critical business services, key processes and material dependencies.
  
• Facilitate severe but plausible scenario analysis and resilience testing exercises.
  
• Monitor resilience vulnerabilities and support management in implementing corrective actions.
  
• Promote integration between operational risk management, business continuity, crisis management and technology resilience activities.
  

Information Security and ICT Risk Oversight

• Provide independent oversight and challenge of information security and ICT risk management practices.
  
• Review and assess material technology, cyber security and digital transformation initiatives from a risk perspective.
  
• Monitor significant technology and cyber security risk exposures and ensure timely escalation of material concerns.
  
• Support the assessment of technology resilience, information security controls and cyber preparedness.
  
• Ensure technology and information security risks are appropriately incorporated into the Bank's risk profile and governance reporting.
  

Third-Party Risk Management

• Oversee the implementation and effectiveness of the Third-Party Risk Management Framework.
  
• Review and challenge risk assessments relating to outsourcing arrangements, service providers and strategic partnerships.
  
• Monitor critical supplier dependencies, concentration risks and resilience capabilities.
  
• Ensure third-party risks are appropriately considered in operational resilience, business continuity and risk assessment activities.
  
• Support governance oversight of material outsourcing and vendor relationships.
  

Digital Fraud and Financial Crime Risk Support

• Support the development and enhancement of the Bank's digital fraud risk management capability.
  
• Monitor emerging fraud threats, attack trends and technology-enabled fraud risks.
  
• Coordinate with business, technology, operations and security teams to strengthen fraud prevention, detection and response capabilities.
  
• Analyse fraud events and trends and support the identification of strategic risk mitigation initiatives.
  
• Provide oversight and reporting of fraud-related risks within the broader non-financial risk framework.
  

Emerging Risk Management

• Monitor internal and external developments that may give rise to emerging non-financial risks.
  
• Assess the risk implications of digital transformation, changing business models, regulatory developments, geopolitical events and evolving threat landscapes.
  
• Support the development of risk assessments and mitigation strategies for emerging risk themes.
  
• Provide forward-looking analysis and insight to support strategic decision making.
  

Regulatory, Audit and Committee Engagement

• Support the CRO in engagements with regulators, external auditors and other assurance providers.
  
• Coordinate responses to regulatory reviews, thematic assessments and audit findings.
  
• Monitor the implementation and closure of agreed remediation actions.
  
• Prepare high-quality risk reports and management information for governance committees and senior management forums.
  
• Act as a trusted adviser to management on non-financial risk matters.
  

Risk Culture and Capability Development

• Promote a strong and sustainable risk culture across the organisation.
  
• Facilitate risk awareness and training initiatives relating to operational and non-financial risks.
  
• Encourage proactive identification, escalation and management of risks and control issues.
  
• Support management in embedding risk-based decision making throughout the organisation.
  

Non-Financial Risk Strategy and Governance

• Support the CRO in developing and maintaining the Bank's Non-Financial Risk Management Framework, policies, standards and methodologies.
  
• Drive the continuous enhancement of the Bank's non-financial risk management capabilities and maturity.
  
• Assist in the development and monitoring of risk appetite statements, tolerance levels, key risk indicators and governance reporting.
  
• Monitor emerging regulatory requirements, industry developments and evolving risk trends.
  
• Provide strategic advice and independent challenge to management regarding significant non-financial risk exposures and control weaknesses.
  
• Support the preparation of risk management papers and presentations for Executive Management, Board Committees and regulators.
  

Operational Risk Management

• Oversee the implementation and ongoing effectiveness of the Operational Risk Management Framework.
  
• Coordinate and challenge Risk and Control Self-Assessments (RCSA), risk assessments and control effectiveness reviews across the Bank.
  
• Oversee operational risk event and incident management processes, including root-cause analysis, lessons learned and remediation tracking.
  
• Monitor operational loss events, risk trends and control weaknesses and ensure material issues are appropriately escalated.
  
• Facilitate the development and monitoring of operational risk indicators and early warning metrics.
  
• Provide independent review and challenge regarding risk treatment plans and risk acceptance decisions.
  

Operational Resilience and Business Continuity

• Support the design, implementation and continuous enhancement of the Bank's Operational Resilience Framework.
  
• Lead the Bank's Business Continuity Management programme, including business impact assessments, continuity planning, testing and recovery exercises.
  
• Coordinate resilience assessments covering critical business services, key processes and material dependencies.
  
• Facilitate severe but plausible scenario analysis and resilience testing exercises.
  
• Monitor resilience vulnerabilities and support management in implementing corrective actions.
  
• Promote integration between operational risk management, business continuity, crisis management and technology resilience activities.
  

Information Security and ICT Risk Oversight

• Provide independent oversight and challenge of information security and ICT risk management practices.
  
• Review and assess material technology, cyber security and digital transformation initiatives from a risk perspective.
  
• Monitor significant technology and cyber security risk exposures and ensure timely escalation of material concerns.
  
• Support the assessment of technology resilience, information security controls and cyber preparedness.
  
• Ensure technology and information security risks are appropriately incorporated into the Bank's risk profile and governance reporting.
  

Third-Party Risk Management

• Oversee the implementation and effectiveness of the Third-Party Risk Management Framework.
  
• Review and challenge risk assessments relating to outsourcing arrangements, service providers and strategic partnerships.
  
• Monitor critical supplier dependencies, concentration risks and resilience capabilities.
  
• Ensure third-party risks are appropriately considered in operational resilience, business continuity and risk assessment activities.
  
• Support governance oversight of material outsourcing and vendor relationships.
  

Digital Fraud and Financial Crime Risk Support

• Support the development and enhancement of the Bank's digital fraud risk management capability.
  
• Monitor emerging fraud threats, attack trends and technology-enabled fraud risks.
  
• Coordinate with business, technology, operations and security teams to strengthen fraud prevention, detection and response capabilities.
  
• Analyse fraud events and trends and support the identification of strategic risk mitigation initiatives.
  
• Provide oversight and reporting of fraud-related risks within the broader non-financial risk framework.
  

Emerging Risk Management

• Monitor internal and external developments that may give rise to emerging non-financial risks.
  
• Assess the risk implications of digital transformation, changing business models, regulatory developments, geopolitical events and evolving threat landscapes.
  
• Support the development of risk assessments and mitigation strategies for emerging risk themes.
  
• Provide forward-looking analysis and insight to support strategic decision making.
  

Regulatory, Audit and Committee Engagement

• Support the CRO in engagements with regulators, external auditors and other assurance providers.
  
• Coordinate responses to regulatory reviews, thematic assessments and audit findings.
  
• Monitor the implementation and closure of agreed remediation actions.
  
• Prepare high-quality risk reports and management information for governance committees and senior management forums.
  
• Act as a trusted adviser to management on non-financial risk matters.
  

Risk Culture and Capability Development

• Promote a strong and sustainable risk culture across the organisation.
  
• Facilitate risk awareness and training initiatives relating to operational and non-financial risks.
  
• Encourage proactive identification, escalation and management of risks and control issues.
  
• Support management in embedding risk-based decision making throughout the organisation.