Risk Lead

Role

Purpose:

To lead the design, implementation, and ongoing management of Company's Enterprise Risk Management (ERM) framework, ensuring alignment with ISO 31000, COSO ERM 2017, and applicable Saudi regulatory requirements. The role is responsible for building and maintaining a robust risk identification, assessment, and reporting capability across the organization, integrating risk management into strategic and operational decision-making and supporting the overall GRC & Cybersecurity function.

• Design and implement an integrated ERM framework aligned with ISO 31000 and COSO ERM 2017, including risk appetite statements, tolerance thresholds, capacity modelling, and risk culture diagnostics.
• Own and maintain the enterprise risk register, ensuring accurate risk classification, taxonomies, ownership assignment, escalation of critical risks, and alignment with organizational risk appetite.
• Lead top-down and bottom-up risk identification workshops across business units and functions, facilitating structured risk assessments using qualitative heat maps, scenario analysis, and quantitative techniques including Monte Carlo simulation.
• Design, implement, and monitor Key Risk Indicators (KRIs) and Key Control Indicators (KCIs), establishing threshold-based alerting and reporting mechanisms for executive and board audiences.
• Lead Risk and Control Self-Assessment (RCSA) facilitation exercises across departments and maintain control effectiveness monitoring processes.
• Develop and maintain operational risk management capabilities including risk taxonomy, loss event databases, business process risk mapping, and control matrices.
• Support third-party and supply chain risk management activities including vendor risk tiering, due diligence program design, SLA performance monitoring, and concentration risk analysis.
• Lead project and program risk management support, including risk register design, RAID log facilitation, contingency modelling, and post-project lessons-learned reviews.
• Design and manage executive and Board-level risk reporting including dashboards, heat maps, and RAG status reporting; establish risk reporting cadence and escalation protocols.
• Support the design and implementation of internal controls frameworks aligned with COSO Internal Control – Integrated Framework, including control documentation, SoD analysis, and deficiency remediation.
• Monitor emerging risks including geopolitical, climate, technology, and regulatory developments and translate findings into actionable risk management recommendations.
• Collaborate with GRC & Cybersecurity, Internal Audit, Finance, Legal, and Business Units to ensure risk management is embedded into organizational processes, investment decisions, and project delivery.
• Support the selection and implementation of GRC technology platforms as they relate to risk management workflows, risk register automation, and integrated reporting.
• Prepare and present periodic risk management reports and KRI updates for senior management and board-level committees including the Audit & Risk Committee (ARC).

Qualifications: Bachelor's degree in Risk Management, Finance, Business Administration, Economics, or a related field. A Master's degree in Risk Management, Finance, or MBA is preferred.

• Certified in Risk and Information Systems Control (CRISC)
• Professional Risk Manager (PRM) or Financial Risk Manager (FRM) – preferred
• ISO 31000 Risk Management Lead Implementer or Auditor
• Certified Risk Management Professional (CRMP) – preferred