Lead Operational Risk Specialist – EWS Operations

About the role

The Lead Operational Risk Specialist will build and operationalize the risk management framework across EWS Operations, moving beyond static risk logs and reactive controls to a data-driven system covering technology evolution, vendor dependencies, platform rationalization and crisis resilience. The role partners with Operations, Technology, Product, DevOps and Compliance, and sits within Security Governance and Compliance.

Key responsibilities

• Shape the operational risk strategy: design, deploy and operationalize the risk framework, risk appetite statements and RCSA processes aligned to executive business strategy.
• Build automated KRI dashboards and executive reporting to give senior tech leadership visibility into top operational exposures.
• Lead crisis readiness and business continuity: run business impact analyses to define RTO/RPO standards and conduct crisis simulations.
• Evaluate the operational impact of security events and orchestrate cross-functional responses to reduce downtime.
• Lead post-incident root cause analysis, turning findings into tracked control improvements.
• Embed risk evaluation in legacy system rationalization and build processes to audit and mitigate third-party vendor, API and platform dependencies.
• Partner with engineering and DevOps to design automated internal controls, and act as the main partner for internal audit and regulatory alignment.

Required profile

• 6+ years of progressive experience in operational risk, technology risk, IT audit or operational resilience in complex, cloud-enabled environments.
• B2+ English proficiency.
• Proven experience building or scaling risk frameworks, control environments or BCDR programs in tech or operations units.
• Ability to influence cross-functional engineering and operational teams without direct line authority.

Required skills

• Deep understanding of cloud environments, system dependency mapping and technology change management.
• Hands-on experience turning operational incidents into business impact assessments and remediation plans.
• Nice to have: CRISC, CISA, CBCP or ISO 31000/27001 Lead Implementer certification.