Head of Operational Risk Management

About us

Role Summary

requirements

Key responsibilities

• Design, implement, and maintain the foundational pillars of the Operational Risk Management (ORM) framework, including policies, governance structures, and methodologies.
• Lead the implementation and ongoing execution of the RCSA methodology across all departments (e.g., HR, operations, finance, business, technology) to proactively identify, evaluate, and manage inherent risks and control effectiveness.
• Design, maintain, and regularly update comprehensive Operational Risk Registers and loss event databases, ensuring accurate classification and timely reporting of incidents.
• Develop and monitor relevant Key Risk Indicators (KRIs) and thresholds specific to operational risk, providing early warning signals for potential control failures.
• Develop and implement a formal, clear, and organization-wide Incident Reporting Process for operational risk and near-miss events, ensuring all staff can easily report issues in a consistent manner.
• Ensure timely and accurate reporting of all major operational and cyber security incidents to SAMA, adhering strictly to mandated thresholds, content requirements, and reporting timelines.
• Oversee and enforce the mandatory use of Root Cause Analysis for all material incidents to ensure that control weaknesses are identified and permanently remediated.
• Oversee and provide strategic direction to the Fraud Risk Manager, ensuring the development and execution of an effective, end-to-end fraud prevention, detection, and response program, including managing the internal whistleblowing and fraud investigation processes.
• Collaborate closely with the Technology and Cybersecurity teams to manage and mitigate Technology Risk and Cyber Security Risk, including risks related to system failures, data integrity, platform changes, and third-party vendor reliance.
• Conduct mandatory operational risk training for all employees and management to foster a strong risk-aware culture, emphasizing the importance of effective control performance and accountability.
• Prepare detailed, high-quality ORM reports for the CRO, Executive Management, and the Board Risk Committee, highlighting material exposures, control deficiencies, and progress on remediation plans.

Qualifications & Skills

• Bachelor’s degree in Business, Finance, Risk Management, or a related quantitative field. A professional certification is strongly preferred.
• Minimum of 8-10 years of experience in Operational Risk Management within the financial services sector, with at least 4 years in a leadership or managerial capacity.

Experience

• in a Fintech or a digitally-focused environment is highly advantageous.
• Deep, practical experience in implementing and running core ORM tools, including RCSA, loss data collection, scenario analysis, and KRI monitoring.
• Solid understanding of SAMA's requirements and expectations regarding operational risk, governance, and business continuity, especially as they apply to technology-driven financial institutions.
• Proven experience in establishing or significantly contributing to a formal Fraud Risk Management program.
• Communication: Excellent verbal and written communication skills in both English and Arabic to effectively liaise with technical teams, senior management, and the CRO.
• Desirable skills:
• Relevant professional certifications such as Certified Operational Risk Professional (CORP), Certified Fraud Examiner (CFE), or PRM/FRM with a focus on non-financial risks.
• Direct experience with mortgage financing or other asset-backed lending processes, understanding the associated operational pitfalls.
• Prior experience in technology risk, IT audit, or internal audit, providing a deep understanding of internal controls within a highly automated environment.
• Advanced skills in process mapping and control optimization to drive efficiency while maintaining control effectiveness.