Senior Operational Risk Manager

General

Job Title: Senior Operational Risk Manager

Division: General Management – Risk & Compliance

Reports To: Head of Operational Risk

Key Relationships First line internal stakeholders include Procurement and Vendor Management, IT, Data, Underwriters and Claims Managers. This includes supporting first line stakeholders in the management of operational risk and key TPRM-related regulatory relationships across the group. Second and third line stakeholders include the Risk Management team (Insurance Risk and Enterprise Risk Management team members), Risk Management Senior Leadership Team, Chief Risk Officer and wider team members of second and third line functions (Compliance and Internal Audit).

Job Summary The role supports the Head of Operational Risk in the oversight and management of operational risk matters across the group, with a particular focus on third party risk activities. It is also responsible for providing independent second-line oversight, challenge, and assurance over the organisation’s management of risks, including those arising from third parties, outsourced services, and strategic suppliers.

The role has primary responsibility for the management of operational risks across a number of business areas, including Delegated Authority, Facilities Management and Talent Management. It also has a particular focus on the design, maintenance, and oversight of the group’s third party risk management framework, ensuring that third party risks are identified, assessed, monitored, and managed in line with the firm’s risk appetite, regulatory requirements, and operational resilience objectives.

Key Responsibilities Risk Management Framework

• Provide independent oversight and effective challenge to first-line operational risk activities.
• Review, challenge and contribute to the Third Party Risk Management (TPRM) framework, policies and standards.
• Support the Head of Operational Risk in facilitating regular Risk & Control Self Assessments (RCSAs) with first line risk owners and stakeholders, ensuring the assessments are performed and documented accordingly.
• Oversee the management of delegated authority risk within Underwriting, Claims and Operations as part of the TPRM framework.
• Ensure consistent risk tiering and materiality assessments for all third parties.
• Review and challenge residual risk assessments, risk acceptances, and exceptions related to Operational Risk.
• Oversee integration of Third Party Risk into operational resilience, technology, cyber, and data frameworks.
• Support the implementation and maintenance of a robust control environment with clear ownership and accountability within the business, ensuring control documentation remains accurate and current.
• Develop and monitor key risk indicators (KRIs) and support risk appetite monitoring and management.
• Work collaboratively with 1st Line and Risk domain teams, supporting the embedding of the Operational Risk and TPRM framework into the organisation and across the 3 Lines of Defence model.
• Act as the appropriate liaison across the 3 Lines of Defence model, including 1st Line colleagues, Risk Owners, Compliance and Internal Audit functions, Operational Resilience, and risk domains including Information Security and Sustainability.

Risk Oversight and Reporting

• Provide review, credible challenge and 2nd Line insights over 1st Line decision-focused risk reporting, dashboards, and actively participate in any thematic deep dives, with particular focus on Third Party and broader risk areas.
• Provide independent risk opinions on emerging operational risk themes.
• Investigate and report operational risk incidents, ensuring lessons learned are captured and implemented
• Support ORSA, scenario testing, and stress testing, in particular where Third Party dependencies are classed as material.
• Identify systemic risks and concentration vulnerabilities related to TPRM.
• Challenge the quality, completeness, and relevance of first-line reporting and MI, ensuring they support effective risk management and align with risk appetite.

Regulatory And Governance Responsibilities

• Support compliance with regulatory expectations relating to third party, outsourcing and broader operational risks.
• Act as a second-line point of contact for regulators and Internal Audit.
• Ensure clear governance, escalation, and documentation of third-party risk decisions.
• Promote…