Director of Operational Risk

Director of Operational Risk - Second Line of Defence (2LOD) - London

Job description

We are recruiting for a Director of Operational Risk to join our client, a Financial Services firm, in their team for this permanent opportunity.

About the role

The client is seeking an experienced Director of Operational Risk to lead the operational risk agenda for the UK legal entity from our London office. Reporting to the Global Head of Enterprise Risk and SFL Head of Risk, this is a senior Second Line of Defence (2LOD) role responsible for the design, oversight and continuous improvement of the operational risk framework across the Firm’s regulated activities.

The candidate will act as a trusted, self-directed risk leader who can independently own and discharge the entity’s local operational risk and regulatory obligations — including engagement with the Financial Conduct Authority (FCA), compliance with the Digital Operational Resilience Act (DORA), and coordination with the National Futures Association (NFA) and other applicable authorities. A defining expectation of the role is the ability to escalate promptly and transparently to the Global Head of Enterprise Risk and the SFL Head of Risk (SMF4) at the earliest indication of any local risk concern, control weakness, incident or emerging regulatory matter.

Key responsibilities include; Serve as the primary operational risk point of contact for UK and applicable overseas regulators, including the FCA and NFA, managing information requests, thematic reviews, and supervisory engagement independently and to a high professional standard. Own the entity’s compliance with the EU/UK Digital Operational Resilience Act (DORA), including ICT risk management, digital operational resilience testing, ICT third-party risk oversight, and major ICT-related incident reporting obligations. Maintain current knowledge of the FCA Handbook (SYSC, SM&CR), operational resilience requirements (important business services, impact tolerances and mapping) and the MIFIDPRU / ICARA regime as it relates to operational risk. Interpret new and evolving regulations, assess entity impact, and translate requirements into practical, embedded controls and framework updates without requiring day-to-day direction. Prepare regulator-ready responses, attestations and submissions, ensuring language is accurate, proportionate and defensible. Independently manage the day-to-day operational risk activities of the UK entity, including Risk & Control Self-Assessments (RCSA), control monitoring plans, key risk indicators (KRIs) and risk appetite monitoring. Oversee the operational risk event / loss data capture process, ensuring timely recording, root-cause analysis, and remediation tracking to closure. Provide 2LOD challenge and oversight to First Line of Defence (1LOD) risk and control activities across front office, operations and support functions. Support operational risk scenario analysis and capital assessment inputs feeding the entity’s ICARA, including frequency and severity calibration where required. Lead the operational risk aspects of the entity’s incident management lifecycle — identification, triage, escalation, coordination, resolution and post-incident review — in line with FCA operational resilience and DORA incident-reporting expectations. Ensure incidents that breach impact tolerances or regulatory reporting thresholds are escalated immediately and reported to the relevant authority within required timeframes. Escalate to the Global Head of Enterprise Risk at the earliest sign of a material incident or emerging local concern, providing a clear, factual assessment and recommended actions. Provide 2LOD oversight and challenge of the third-party / outsourcing risk management lifecycle. Ensure ICT third-party arrangements are managed in line with DORA and FCA outsourcing and operational resilience requirements, with appropriate identification of critical or important suppliers and concentration risk. Coordinate with TPRM and procurement teams on control testing, contractual risk provisions and remediation of legacy third-party arrangements. Act as an early-warning function for the Global Head of Enterprise Risk, proactively flagging any local operational risk, control, incident or regulatory concern before it escalates, then informing the SFL Head of Risk. Build effective working relationships with 1LOD business heads, Compliance, Legal, Internal Audit (3LOD), and global risk colleagues across EMEA, APAC, North and Latin America. Represent operational risk at relevant governance forums and risk committees, presenting balanced, evidence-based assessments. Substantial experience in operational risk management within a regulated financial services firm (brokerage, investment firm, banking or capital markets), at a Director level. Demonstrable, hands-on experience of direct regulatory engagement with the FCA and familiarity with the NFA and other applicable EMEA regulators. Working knowledge of DORA and the ability to operationalize its ICT risk management, resilience testing and incident-reporting requirements.

About you

This role reports directly to the Global Head of Enterprise Risk in the US and the SFL Head of Risk, forming part of the 2LOD. The role holder is expected to operate with a high degree of independence in managing local operational risk regulatory requirements, while maintaining an open and timely escalation channel to both the Global Head of Enterprise Risk and SFL Head of Risk on all matters of local concern.

Additional Information: Location: London Duration: Permanent

Are you ready to join the team? Click on the link to apply