Operational Risk Officer

Responsible for leading the design, implementation, and ongoing enhancement of the Bank's Operational Risk Management Framework and provides independent second-line oversight of operational risk across the organization. The role oversees key operational risk programs, including risk and control assessments, operational loss and event management, model risk management, physical security, information security and technology risk, and operational resilience. As a trusted advisor to executive management, the Operational Risk Officer delivers decision-useful risk insights, supports strategic decision-making, and drives continuous improvement in risk management practices across the Bank.

Bachelor's degree in Finance, Accounting, Business Administration, Risk Management, Economics, or related field.

CERP, CRMP, ORMCP, FRM, CRISC preferred.

Fifteen or more years of senior leadership experience in banking, enterprise risk management, operational risk, internal audit, compliance, or related functions. Demonstrated experience designing or managing operational risk frameworks within a regulated financial institution, with Banking-as-a-Service (BaaS) experience preferred. Or equivalent combination of education and experience.

• Owns and maintains the Bank's Operational Risk Management Framework, including related policies, standards, procedures, and methodologies. Develops, maintains, and recommends operational risk appetite metrics, limits, thresholds, and escalation triggers; monitor performance against approved appetite and elevate material breaches or adverse trends.
• Leads enterprise-wide Risk and Control Self-Assessments (RCSAs) and independent challenge processes. Evaluates inherent and residual risks, control effectiveness, and management action plans. Provides independent risk review and challenge of new products, services, material business changes, strategic initiatives, and significant technology implementations to identify and address operational risks prior to implementation.
• Provides training and guidance to business units regarding risk identification and control expectations.
• Provides independent second-line oversight of the Bank's Model Risk Management Program, including model inventory, risk tiering, lifecycle governance, validation, performance monitoring, change controls, exceptions, and issue remediation. Reviews model risk assessments, validation results, key risk indicators, material model changes, and remediation activities; escalates significant issues to executive management and the Board, as appropriate.
• Provides independent second-line oversight of the Bank's physical security program, including facility access controls, security systems, incident management, emergency preparedness, and protection of employees, customers, information, and physical assets. Reviews physical security risk assessments, incident trends, key risk indicators, testing results, and remediation plans; provides effective challenge and escalates material concerns, as appropriate. Assesses physical security risks associated with branches, offices, critical facilities, cash-handling locations, and changes to the Bank's operating footprint.
• Provides independent second-line oversight of Information Security, Cybersecurity, and IT Risk programs, including review of key risk indicators, technology incidents, and control effectiveness.
• Administers the Bank's operational loss event and near-miss reporting process. Conducts or oversees root cause analyses and trend evaluations. Monitors corrective actions to ensure timely and sustainable remediation. Identifies repeat issues requiring executive attention and aggregates operational risk exposures across business units, products, technology platforms, and risk programs to identify concentrations, interconnected risks, and emerging enterprise-level exposures.
• Supports the oversight of business continuity planning and operational resilience initiatives. Monitors testing results, recovery capabilities, and lessons learned from exercises or disruptions. Evaluates resilience risks associated with critical business services and third-party dependencies.
• Supports regulatory examinations and supervisory engagements related to operational risk, including preparation and review of risk assessments, management responses, remediation plans, and supporting materials.
• Leads cross-functional working groups focused on risk reduction and process…