Operational Risk Officer

OnPoint Credit Union•Portland, OR

About The Position

The Operational Risk Officer supports the execution and continued development of OnPoint’s Operational Risk Management Program. The role serves as a second-line risk partner to assigned business areas, providing independent oversight, credible challenge, and subject-matter expertise regarding operational risks, internal controls, risk incidents, and remediation activities. The officer uses financial-services and operational knowledge to identify emerging risks, assess business processes and control environments, lead Risk and Control Self-Assessments (RCSAs), and translate risk information into actionable recommendations. The position partners with business leaders while maintaining second-line independence and does not own or operate the business processes or controls being assessed. The officer serves as the primary Operational Risk contact for assigned business areas, leads assessments and incident reviews, evaluates controls, documents issues, and monitors remediation. The role also monitors risk information, prepares reporting for business leadership and governance committees, contributes to risk-management standards and guidance, and identifies opportunities to improve risk processes.

Requirements

Bachelor’s degree in Finance, Business, Risk Management, Accounting, Economics, or a related discipline, or equivalent relevant work experience in lieu of a degree.
Five years of experience in financial-services operations, operational risk, internal audit, compliance, quality assurance, enterprise risk, or a related field.
Demonstrated experience assessing processes, identifying risks and control weaknesses, and working across business functions to address complex operational matters.
Strong understanding of operational risk management, internal controls, RCSAs, incident management, root-cause analysis, issue management, and remediation oversight.
Significant knowledge of financial-services operations and ability to understand complex processes, systems, transaction flows, vendor relationships, and regulatory dependencies.
Ability to distinguish first-line process and control ownership from second-line oversight, credible challenge, and monitoring responsibilities.
Demonstrated ability to facilitate risk discussions independently, challenge assumptions, and influence stakeholders without direct authority.
Strong analytical and critical-thinking skills, including ability to connect individual incidents and control gaps to broader risk themes.
Ability to assess whether controls are clearly defined, appropriately designed, sustainable, and capable of being evidenced or evaluated.
Excellent written and verbal communication skills, including ability to translate complex operational information into clear risk conclusions and executive-ready reporting.
Strong project-management and organizational skills, including ability to manage multiple complex assessments, incidents, issues, and stakeholder relationships.
Sound judgment, professional skepticism, and ability to escalate concerns constructively.
Proficiency with Microsoft Office.

Nice To Haves

Seven years of financial-services, operational-risk, audit, compliance, quality-control, or related experience.
Experience supporting or leading RCSAs, risk assessments, operational-risk investigations, root-cause analysis, or issue remediation.
Experience preparing risk reporting for senior management or governance committees and supporting internal audit or regulatory examination activities.
Professional certification such as Certified Enterprise Risk Professional (CERP), Credit Union Enterprise Risk Certification (CUERC), Certification in Risk Management Assurance (CRMA), Certified Internal Auditor (CIA), Certified Credit Union Compliance Officer (CUCO), or comparable credential.
Experience with risk, workflow, reporting, or data-analysis tools.

Responsibilities

Serve as the primary Operational Risk contact for assigned business areas and develop an understanding of their products, services, systems, processes, vendors, and operational risk exposure.
Provide independent risk guidance and credible challenge regarding process changes, new initiatives, control design, risk acceptance, and remediation decisions.
Identify and escalate material risks, control weaknesses, emerging concerns, and risks that may exceed established risk appetite.
Coordinate with Enterprise Risk, Compliance, Legal, Information Security, Vendor Management, Internal Audit, and other risk functions on cross-disciplinary matters.
Lead end-to-end Risk and Control Self-Assessments for assigned business processes, including planning, walkthroughs, risk identification and applicability analysis, inherent risk assessment, control documentation and evaluation, and residual risk assessment.
Evaluate whether controls are appropriately designed to mitigate risks and whether their supporting documentation is sufficient, current, and evidence-based.
Challenge business-provided risk ratings, control descriptions, and assessment conclusions.
Identify control gaps, process weaknesses, risks outside appetite, and opportunities to improve process consistency, oversight, automation, or quality control.
Review and investigate operational risk incidents and near misses, including fact gathering, root-cause analysis, control-failure identification, impact assessment, and corrective-action development.
Determine whether incident findings indicate an isolated event, broader control weakness, systemic concern, or matter requiring escalation.
Document self-identified issues, control deficiencies, root causes, risk impacts, and required corrective actions.
Partner with issue owners to develop remediation plans that address root causes; monitor milestones, challenge insufficient actions, and support validation of corrective actions.
Monitor operational risk indicators, incidents, losses, issues, control gaps, process changes, and other relevant information for assigned business areas.
Prepare risk profiles, reports, and presentations for business leadership, Operational Risk management, and governance committees.
Contribute to Operational Risk policies, procedures, standards, templates, training, and guidance, and promote consistent use of methodologies.
Identify opportunities to improve risk-management processes through standardization, automation, workflow tools, and improved data.
Provide guidance and knowledge-sharing to business partners on operational-risk concepts and practices.
Perform additional projects, responsibilities, or other duties as assigned.