Operational Risk Officer

Sutton Bank•Columbus, OH

About The Position

The Operational Risk Officer leads the design, implementation, and ongoing enhancement of the Bank’s Operational Risk Management Framework and provides independent second-line oversight of operational risk across the organization. The role oversees risk and control assessments, operational loss and event management, model risk management, physical security, information security and technology risk, and operational resilience. As a trusted advisor to executive management, the Officer delivers decision-useful risk insights, supports strategic decision-making, and drives continuous improvement in risk management practices. The position owns the Operational Risk Management Framework and associated policies, standards, procedures, and methodologies; develops risk appetite measures and escalation triggers; leads enterprise-wide risk and control assessments; and independently reviews and challenges new products, services, business changes, strategic initiatives, and significant technology implementations. It also oversees second-line programs covering model risk, physical security, information security, cybersecurity, and IT risk, and administers operational loss and near-miss reporting, root cause analysis, trend evaluation, and corrective-action monitoring. The Officer aggregates operational risk exposures to identify concentrations and emerging enterprise risks; supports business continuity and operational resilience oversight; evaluates risks to critical business services and third-party dependencies; and supports regulatory examinations and supervisory engagements. The role leads cross-functional risk-reduction and process-improvement groups and partners with HR on staffing models, hiring, employee performance, corrective action, and development plans.

Requirements

Bachelor’s degree in Finance, Accounting, Business Administration, Risk Management, Economics, or a related field.
Fifteen or more years of senior leadership experience in banking, enterprise risk management, operational risk, internal audit, compliance, or related functions.
Demonstrated experience designing or managing operational risk frameworks within a regulated financial institution, or an equivalent combination of education and experience.
Ability to communicate effectively and clearly in verbal and written communications and present information to a variety of groups.
Critical-thinking skills and experience; ability to work independently, self-motivate, and remain results-oriented.
Strong interpersonal skills to build relationships, collaborate, and communicate; strong organizational skills and business acumen.
Strong analytical skills and ability to manage multiple tasks and think critically.
Ability to respond to common inquiries or complaints from employees, customers, regulatory agencies, or members of the business community.
Ability to influence senior leaders while maintaining independence and objectivity.
Advanced proficiency in Microsoft Excel, PowerPoint, and reporting tools.
Expertise in RCSAs, operational loss reporting, and root cause analysis.
Working knowledge of IT governance, cyber risk management, business continuity, and regulatory expectations for technology risk.
Strong knowledge of model risk management principles, model lifecycle governance, independent validation, performance monitoring, model limitations, and issue management.
Working knowledge of physical security risk management, including access controls, security systems, incident response, facility risk assessments, emergency preparedness, and related governance expectations.
Experience overseeing regulatory, audit, and management action plans, including issue validation, remediation governance, root cause analysis, and escalation of overdue or high-risk issues.
Deep understanding of operational risk management principles and the Three Lines model.
Understanding of operational risks associated with Banking-as-a-Service (BaaS) programs, fintech partnerships, embedded banking relationships, and third-party service integrations.

Nice To Haves

CERP, CRMP, ORMCP, FRM, or CRISC certification.
Banking-as-a-Service (BaaS) experience.

Responsibilities

Own and maintain the Bank’s Operational Risk Management Framework, including related policies, standards, procedures, and methodologies.
Develop, maintain, and recommend operational risk appetite metrics, limits, thresholds, and escalation triggers; monitor performance and escalate material breaches or adverse trends.
Lead enterprise-wide Risk and Control Self-Assessments (RCSAs) and independent challenge processes; evaluate inherent and residual risks, control effectiveness, and management action plans.
Independently review and challenge new products, services, material business changes, strategic initiatives, and significant technology implementations to identify operational risks before implementation.
Provide business units with training and guidance on risk identification and control expectations.
Provide independent second-line oversight of the Bank’s Model Risk Management Program, including model inventory, risk tiering, lifecycle governance, validation, performance monitoring, change controls, exceptions, and issue remediation.
Review model risk assessments, validation results, key risk indicators, material model changes, and remediation activities; escalate significant issues to executive management and the Board as appropriate.
Provide independent second-line oversight of the physical security program, including facility access controls, security systems, incident management, emergency preparedness, and protection of people, information, and physical assets.
Review physical security risk assessments, incident trends, key risk indicators, testing results, and remediation plans; challenge and escalate material concerns as appropriate.
Assess physical security risks related to branches, offices, critical facilities, cash-handling locations, and changes to the Bank’s operating footprint.
Provide independent second-line oversight of Information Security, Cybersecurity, and IT Risk programs, including review of key risk indicators, technology incidents, and control effectiveness.
Administer the operational loss event and near-miss reporting process; conduct or oversee root cause analyses and trend evaluations; monitor corrective actions for timely and sustainable remediation.
Identify repeat issues requiring executive attention and aggregate operational risk exposures across business units, products, technology platforms, and risk programs to identify concentrations, interconnected risks, and emerging enterprise-level exposures.
Support oversight of business continuity planning and operational resilience initiatives; monitor testing results, recovery capabilities, and lessons learned from exercises or disruptions.
Evaluate resilience risks associated with critical business services and third-party dependencies.
Support regulatory examinations and supervisory engagements related to operational risk, including preparing and reviewing risk assessments, management responses, remediation plans, and supporting materials.
Lead cross-functional working groups focused on risk reduction and process improvement.
Partner with HR to ensure staffing models align with FTE allocation; interview and select employees; evaluate performance; and provide corrective action and/or developmental plans.