Director - Operational Risk

Role Overview

StoneX Financial Ltd. is seeking an experienced Director of Operational Risk to lead the operational risk agenda for the UK legal entity from our London office. Reporting to the Global Head of Enterprise Risk and SFL Head of Risk, this is a senior Second Line of Defense (2

LOD) role responsible for the design, oversight and continuous improvement of the operational risk framework across the Firm’s regulated activities.

The candidate will act as a trusted, self-directed risk leader who can independently own and discharge the entity’s local operational risk and regulatory obligations — including engagement with the Financial Conduct Authority (FCA), compliance with the Digital Operational Resilience Act (DORA), and coordination with the National Futures Association (NFA) and other applicable authorities. A defining expectation of the role is the ability to elevate promptly and transparently to the Global Head of Enterprise Risk and the SFL Head of Risk (SMF4) at the earliest indication of any local risk concern, control weakness, incident or emerging regulatory matter.

Key Responsibilities

2.1 Regulatory Oversight & Engagement

• Serve as the primary operational risk point of contact for UK and applicable overseas regulators, including the FCA and NFA, managing information requests, thematic reviews, and supervisory engagement independently and to a high professional standard.
• Own the entity’s compliance with the EU/UK Digital Operational Resilience Act (DORA), including ICT risk management, digital operational resilience testing, ICT third-party risk oversight, and major ICT-related incident reporting obligations.
• Maintain current knowledge of the FCA Handbook (SYSC, SM&CR), operational resilience requirements (important business services, impact tolerances and mapping) and the MIFIDPRU / ICARA regime as it relates to operational risk.
• Interpret new and evolving regulations, assess entity impact, and translate requirements into practical, embedded controls and framework updates without requiring day-to-day direction.
• Prepare regulator-ready responses, attestations and submissions, ensuring language is accurate, proportionate and defensible.

2.2 Business-as-Usual (BAU) Operational Risk Management

• Independently manage the day-to-day operational risk activities of the UK entity, including Risk & Control Self-Assessments (RCSA), control monitoring plans, key risk indicators (KRIs) and risk appetite monitoring.
• Oversee the operational risk event / loss data capture process, ensuring timely recording, root-cause analysis, and remediation tracking to closure.
• Provide 2
  
  LOD challenge and oversight to First Line of Defense (1
  
  LOD) risk and control activities across front office, operations and support functions.
• Support operational risk scenario analysis and capital assessment inputs feeding the entity’s ICARA, including frequency and severity calibration where required.
• Produce clear, concise operational risk reporting for senior management, risk committees and the Board.

2.3 Incident Management

• Lead the operational risk aspects of the entity’s incident management lifecycle — identification, triage, escalation, coordination, resolution and post-incident review — in line with FCA operational resilience and DORA incident-reporting expectations.
• Ensure incidents that breach impact tolerances or regulatory reporting thresholds are escalated immediately and reported to the relevant authority within required time frames.
• Drive lessons-learned and root-cause analysis, converting incident findings into sustainable control improvements and framework enhancements.
• Escalate to the Global Head of Enterprise Risk at the earliest sign of a material incident or emerging local concern,…