Process Risk and Compliance Operations Manager

the opportunity to shape its development, taking on a growing leadership role over time. We are looking for someone with the drive to build something from nothing and push for growing excellence. A Typical Day: Risk Strategy, Frameworks and AI Risk Governance Design and own the CS Risk Appetite Framework — define guardrails, escalation triggers, and pre-approved response actions. This is not a documentation exercise; it requires continuous negotiation with senior leaders and cross-functional partners to calibrate organizational tolerance in a rapidly changing threat environment. Own and evolve the CS Risk Registry as a living strategic instrument. Your job is to challenge what gets prioritized, determine whether risk scores reflect reality, identify risks that automated systems miss entirely (e.g., emergent social engineering tactics, regulatory shifts, insider collusion patterns), and ensure accountability for remediation. Develop and stress-test risk assessment standards — including key risk indicators (KRIs), risk typologies, and emerging threat hypotheses. Critically evaluate whether existing KRIs remain meaningful or whether they have become stale proxies that create false confidence. Support the evolution of models and processes used in detection triage and investigation — not by building models, but by interrogating model assumptions and sources of risk. Establish ongoing governance cadences — risk review boards, quarterly risk assessments, and challenge sessions where risk assumptions are pressure-tested by diverse stakeholders, not simply ratified. Investigations Partnership and Strategic Oversight Collaborate closely with the Insider Threat Investigations to ensure investigative outcomes are systematically captured, contextualized, and integrated into risk governance. Your role is to provide the strategic risk lens — asking: What does this pattern of findings tell us about our risk posture? Where are our blind spots? What should we investigate that we are not? Co-design escalation and review protocols for high-severity investigation findings and risk non-compliant transactions. Ensure that escalation criteria evolve as threat actors adapt, and that protocols account for edge cases that automated triage systems cannot handle. Participate in joint case reviews, postmortems, and incident debriefs to extract systemic insights: Is this a one-off or a pattern? Does this reveal a control gap? Does this change our risk appetite? Provide strategic risk context to the Investigations team — help prioritize investigative focus areas based on risk registry intelligence, KRI trends, and organizational risk appetite rather than solely on case volume or severity scores. Coordinate the feedback loop between investigations and AI-driven detection systems — ensuring that investigative findings inform detection improvements, and that detection model performance is tracked, challenged, and reported as part of the broader risk posture. Root Cause Resolution Program Management Own the end-to-end lifecycle of root cause resolution — from the moment a systemic root cause is identified (through investigations, incidents, postmortems, risk assessments, or AI model failures) through to verified remediation and closure. This is not an analytical exercise alone; it is a program management discipline that requires tracking, accountability, and sustained cross-functional pressure. Maintain and govern a centralized root cause and remediation tracker that captures all identified systemic issues, assigns clear ownership, defines resolution milestones and deadlines, and provides real-time visibility into remediation progress. Ensure this tracker is reviewed at regular governance cadences and escalated when timelines slip. Distinguish between symptomatic fixes and true root cause resolution. Challenge teams that propose surface-level patches and advocate for structural solutions — even when they are harder, slower, or require investment from teams outside CS. Escalate to senior leadership when organizational inertia prevents meaningful remediation. Drive cross-functional remediation workstreams — coordinate across relevant partner teams to ensure that root cause resolution plans are resourced, sequenced, and executed. Hold workstream owners accountable through regular status reviews, blockers identification, and executive escalation where necessary. Track resolution effectiveness over time — monitor whether implemented fixes actually reduce the recurrence of the underlying risk. If a root cause was "resolved" but the same pattern reappears, re-open the issue and drive a deeper investigation into why the fix failed. Integrate root cause intelligence into the risk registry and risk appetite framework — ensure that patterns of recurring root causes inform risk scoring, KRI design, and strategic risk priorities. If the same category of root cause keeps surfacing, that is a signal that the risk framework itself needs adjustment. Report on root cause resolution health to senior leadership — including metrics on open vs. closed root causes, average time to resolution, aging items, recurrence rates, and cross-functional accountability. Make this a standing component of executive risk reporting. Executive Reporting and Risk Communication Craft and deliver executive-level risk narratives, provide the interpretive layer that tells leadership what the data means, what decisions are required, and what trade-offs are at stake. This requires the ability to synthesize ambiguous, incomplete, and sometimes contradictory signals into a coherent story under time pressure. Own the reporting architecture — determine what should be measured, how it should be presented, and to whom. Challenge vanity metrics and advocate for indicators that reflect actual risk exposure. Define and maintain monitoring thresholds and escalation triggers in collaboration with the Investigations Manager — ensuring these thresholds are calibrated to real-world