Operational Risk Officer

Sutton Bank•Columbus, OH

About The Position

The Operational Risk Officer leads the design, implementation, and ongoing enhancement of Sutton Bank’s Operational Risk Management Framework and provides independent second-line oversight of operational risk across the organization. The role oversees risk and control assessments, operational loss and event management, model risk management, physical security, information security and technology risk, and operational resilience. As a trusted advisor to executive management, the Officer delivers decision-useful risk insights, supports strategic decision-making, and drives continuous improvement in risk management practices. The Officer owns the framework and its related policies, standards, procedures, and methodologies; develops and monitors operational risk appetite measures; leads enterprise-wide risk assessments and independent challenge; and reviews proposed products, services, business changes, strategic initiatives, and technology implementations. The role also oversees model risk, physical security, and information security, cybersecurity, and IT risk programs; manages loss-event and near-miss reporting and follow-up; and supports business continuity, operational resilience, regulatory examinations, and supervisory engagements. The role leads cross-functional risk-reduction and process-improvement groups. It also partners with HR on staffing models, interviews and selects employees, evaluates performance, and provides corrective action or developmental plans.

Requirements

Bachelor’s degree in Finance, Accounting, Business Administration, Risk Management, Economics, or a related field.
Fifteen or more years of senior leadership experience in banking, enterprise risk management, operational risk, internal audit, compliance, or related functions.
Demonstrated experience designing or managing operational risk frameworks within a regulated financial institution, or an equivalent combination of education and experience.
Ability to communicate clearly and effectively verbally and in writing, and present information to varied groups.
Critical-thinking skills and experience; ability to work independently, self-motivate, and achieve results.
Strong interpersonal, relationship-building, collaboration, organizational, analytical, and business-acumen skills; ability to manage multiple tasks.
Ability to respond to common inquiries or complaints from employees, customers, regulatory agencies, or members of the business community.
Ability to influence senior leaders while maintaining independence and objectivity.
Advanced proficiency in Microsoft Excel, PowerPoint, and reporting tools.
Expertise in RCSAs, operational loss reporting, and root cause analysis.
Working knowledge of IT governance, cyber risk management, business continuity, and regulatory expectations for technology risk.
Strong knowledge of model risk management principles, model lifecycle governance, independent validation, performance monitoring, model limitations, and issue management.
Working knowledge of physical security risk management, including access controls, security systems, incident response, facility risk assessments, emergency preparedness, and related governance expectations.
Experience overseeing regulatory, audit, and management action plans, including issue validation, remediation governance, root cause analysis, and escalation of overdue or high-risk issues.
Deep understanding of operational risk management principles and the Three Lines model.
Understanding of operational risks associated with Banking-as-a-Service (BaaS) programs, fintech partnerships, embedded banking relationships, and third-party service integrations.

Nice To Haves

CERP, CRMP, ORMCP, FRM, or CRISC certification preferred.
Banking-as-a-Service (BaaS) experience preferred.

Responsibilities

Own and maintain the Bank’s Operational Risk Management Framework, including related policies, standards, procedures, and methodologies.
Develop, maintain, and recommend operational risk appetite metrics, limits, thresholds, and escalation triggers; monitor performance and escalate material breaches or adverse trends.
Lead enterprise-wide Risk and Control Self-Assessments (RCSAs) and independent challenge processes; evaluate inherent and residual risks, control effectiveness, and management action plans.
Conduct independent risk review and challenge of new products, services, material business changes, strategic initiatives, and significant technology implementations before implementation.
Provide risk identification and control-expectation training and guidance to business units.
Provide independent second-line oversight of the Model Risk Management Program, including model inventory, risk tiering, lifecycle governance, validation, monitoring, change controls, exceptions, and issue remediation.
Review model risk assessments, validation results, key risk indicators, material model changes, and remediation; escalate significant issues to executive management and the Board as appropriate.
Provide independent second-line oversight of the physical security program, including access controls, security systems, incident management, emergency preparedness, and protection of people, information, and physical assets.
Review physical security assessments, incident trends, indicators, testing, and remediation plans; challenge and escalate material concerns and assess risks related to facilities and changes in the Bank’s operating footprint.
Provide independent second-line oversight of Information Security, Cybersecurity, and IT Risk programs, including review of key risk indicators, technology incidents, and control effectiveness.
Administer operational loss-event and near-miss reporting; conduct or oversee root cause analyses and trend evaluations; and monitor corrective actions for timely, sustainable remediation.
Identify repeat issues requiring executive attention and aggregate exposures across business units, products, technology platforms, and risk programs to identify concentrations, interconnected risks, and emerging enterprise exposures.
Support oversight of business continuity planning and operational resilience; monitor test results, recovery capabilities, and lessons learned; and evaluate resilience risks involving critical business services and third parties.
Support regulatory examinations and supervisory engagements related to operational risk, including preparation and review of risk assessments, management responses, remediation plans, and supporting materials.
Lead cross-functional working groups focused on risk reduction and process improvement.
Partner with HR on staffing models and FTE allocation; interview and select employees; evaluate performance; and provide corrective action or developmental plans.