Enterprise Risk Management (ERM) Manager

University Corporation for Atmospheric Research (UCAR)•Boulder, CO

5d•$113,470 - $141,840•Hybrid

About The Position

UCAR is seeking a forward-thinking Enterprise Risk Management (ERM) Manager to lead and mature the organization’s risk strategy. This cross-functional leadership role serves as a strategist and operational catalyst for risk assessment and mitigation, incident response and recovery, business continuity, and corporate compliance. The manager works with the Risk, Assurance, and Compliance (RAC) team and stakeholders across the organization. The role leads risk assessments, mitigation planning, risk reporting, and horizon scanning; coordinates incident response and recovery; manages an integrated business continuity program; and partners with the Director of RAC on organization-wide compliance. It also includes managing the ERM budget and completing professional development and performance-review activities. The position requires a U.S. person, as defined in the posting.

Requirements

Master’s degree in business or related operational management, or five years of comparable experience.
General experience performing enterprise risk management responsibilities, such as risk assessment, mitigation planning, and risk reporting.
Demonstrated experience leading incident response efforts, including coordinating cross-functional teams and subject matter experts during critical events.
Working knowledge of business continuity principles, frameworks, and planning methodologies, such as business impact analysis and recovery strategy development.
Experience working effectively within matrixed organizations.
Knowledge of quantitative and qualitative data collection and analysis methods.
Knowledge of risk-related standards such as ISO 22301, ISO 31000, NFPA emergency response standards, the Incident Command System, NIST 800-37, or similar.
Project management experience and skills.
Ability to respect and bring together diverse perspectives and needs and build high-performance teams.
Excellent verbal and written communication skills for varied audiences and constituencies.
Ability to handle confidential and sensitive matters with discretion.
Demonstrated leadership and complex organizational management skills.
Ability to achieve results in a complex environment.
Continuous improvement mindset and ability to collaborate cross-functionally to improve outcomes.
Must qualify as a U.S. person: a U.S. citizen, a lawful permanent resident, or a protected individual as defined by 8 USC 1324b(a)(3).

Nice To Haves

Previous risk management experience in a Federally Funded Research and Development Center (FFRDC) or similar environment.
Understanding of commercial insurance lines and how they interact with an organization’s overall risk appetite.
Professional certification from RIMS, Disaster Recovery Institute International, the Business Continuity Institute, or similar.

Responsibilities

Conduct periodic internal risk assessments with the Director of RAC and Internal Audit; identify, prioritize, and document key risks.
Recommend risk mitigation and control measures to leadership and provide assistance as appropriate.
Perform external risk horizon scans, monitor emerging risks, and advise executive leadership.
Build and use tools, scorecards, and dashboards to track and report risks for RAC and leadership.
Lead short- and long-term risk mitigation efforts assigned by the COO or Director of RAC.
Advise departments on risk mitigation and operational resilience when requested.
Facilitate cross-functional risk assessments that consider interdependencies and internal, external, existing, and emerging risks.
Work with leadership to define organizational risk appetite, strengthen risk culture, and encourage a proactive approach.
Coordinate incident response during critical organizational events with subject matter experts and leadership.
Conduct after-action assessments and incident response reviews.
Partner with UCAR Communications on accurate, timely, and strategic incident response and recovery messaging.
Maintain readiness through UCAR response plans and incident response resources.
Oversee the incident response program through planning, training, and exercises.
Integrate incident response team plans with LCPO tactical response plans, such as cyber response and aviation incidents.
Prepare executive summaries and technical briefings for leadership, legal counsel, and insurance partners documenting incidents.
Manage activities to develop an integrated organization-wide business continuity program and champion senior leadership support for it.
Develop and maintain the framework, processes, and procedures departments use to establish business continuity plans.
Coach department representatives in business impact analyses, risk assessments, gap analyses, recovery strategy development, and business continuity plan writing.
Ensure business continuity plans are regularly exercised, reviewed, updated, and integrated.
Partner with the Director of RAC and organization-wide stakeholders to establish and monitor compliance requirements, research requirements for new initiatives, and periodically report compliance status to leadership.
Complete required professional development, including goal-setting, training, and participation in performance reviews.
Manage the enterprise risk management budget, spending, requests for incremental increases, and routine budget planning and reconciliation.