Enterprise Risk Management (ERM) Manager

University Corporation for Atmospheric Research•Boulder, CO

4d•$113,470 - $141,840•Hybrid

About The Position

UCAR is seeking a forward-thinking Enterprise Risk Management (ERM) Manager to lead and mature its organizational risk strategy. This cross-functional leadership role is responsible for risk assessment and mitigation, incident response and recovery, business continuity, and corporate compliance. The manager works closely with the Risk, Assurance, and Compliance (RAC) team and employees across the organization, including leadership and subject matter experts. The role requires a U.S. Person: a U.S. citizen, a lawful permanent resident, or a protected individual as defined by 8 USC 1324b(a)(3). The ERM Manager conducts internal and external risk assessments, advises leaders on mitigation and controls, coordinates incident response and recovery, develops and maintains business continuity programs, and partners with stakeholders to monitor compliance requirements. The role also manages the ERM budget and participates in professional development and performance review activities. The position is regular, with a hiring range of $113,470 to $141,840. Final salary depends on education, experience, and relevant skills. UCAR positions must be performed within the United States, excluding U.S. Territories. Hybrid staff work on-site three days per week or an equivalent arrangement.

Requirements

Master’s degree in business or related operational management, or five years of comparable experience.
General experience performing enterprise risk management responsibilities, including risk assessment, mitigation planning, and risk reporting.
Demonstrated experience leading incident response efforts and coordinating cross-functional teams and subject matter experts during critical events.
Working knowledge of business continuity principles, frameworks, and planning methodologies, such as business impact analysis and recovery strategy development.
Experience working effectively within matrixed organizations.
Knowledge of quantitative and qualitative data collection and analysis methods.
Knowledge of risk-related standards such as ISO 22301, ISO 31000, NFPA emergency response standards, the Incident Command System, NIST 800-37, or similar.
Project management experience and skills.
Ability to respect and bring together diverse perspectives and needs and build high-performance teams.
Excellent verbal and written communication skills for large and small audiences, one-on-one interactions, and a wide range of constituencies.
Ability to handle confidential and sensitive matters with discretion.
Demonstrated leadership and complex organizational management skills.
Ability to achieve results in a complex environment.
Continuous improvement mindset and ability to collaborate cross-functionally to create tools, resources, capabilities, or processes that improve outcomes.
Must qualify as a U.S. Person: a U.S. citizen, lawful permanent resident, or protected individual as defined by 8 USC 1324b(a)(3).

Nice To Haves

Previous risk management experience in a Federally Funded Research and Development Center (FFRDC) or similar environment.
Understanding of commercial insurance lines and how they interact with an organization's overall risk appetite.
Professional certification from RIMS, Disaster Recovery Institute International, the Business Continuity Institute, or similar.

Responsibilities

Conduct periodic internal risk assessments with the Director of RAC and Internal Audit to identify, prioritize, and document key risks.
Recommend risk mitigation and control measures to leadership and provide assistance as appropriate.
Perform external risk horizon scans, monitor emerging risks, and advise executive leadership.
Develop and use tools, scorecards, and dashboards to track and report risks for RAC and leadership.
Lead short- and long-term risk mitigation efforts as assigned by the COO or Director of RAC.
Advise departments on risk mitigation and operational resilience as requested.
Facilitate cross-functional risk assessments that consider interdependencies, internal and external factors, and existing and emerging risks.
Work with leadership to define organizational risk appetite, strengthen risk culture, and promote a proactive approach to risk.
Coordinate incident response during critical organizational events with subject matter experts and leadership.
Conduct after-action assessments and incident response reviews to support continuous improvement.
Partner with UCAR Communications on accurate, timely, and strategic incident response and recovery messaging.
Maintain readiness and enhance capabilities through response plans, resources, planning, training, and exercises.
Integrate incident response team plans with LCPO tactical response plans, such as cyber response and aviation incidents.
Prepare executive summaries and technical briefings for leadership, legal counsel, and insurance partners following incidents.
Manage activities to establish a coherent, integrated business continuity program across the organization.
Foster senior leadership support for business continuity.
Develop and maintain the framework, processes, and procedures departments use to create operational continuity plans.
Coach department representatives through business impact analyses, risk and gap analyses, recovery strategy development, and business continuity plan writing.
Manage a program to ensure business continuity plans are exercised, reviewed, updated, and integrated.
Partner with the Director of RAC and organization-wide stakeholders to establish and monitor compliance requirements, research requirements for new initiatives, and report compliance status to leadership.
Complete required professional development, including goal-setting, training, and participation in performance reviews.
Manage the ERM budget, spending, requests for incremental increases, and routine budget planning and reconciliation.