Operational Risk & Assurance Manager
About the role
The Operational Risk & Assurance Manager will be responsible for managing the operational risk register, defining and tracking key risk indicators, and preparing risk reports for leadership. The role involves running monthly and quarterly reviews with business verticals, maintaining incident records, mapping people risk, and ensuring operational continuity. The manager will also lead compliance and assurance activities, including maturity assessments, SOP upkeep, and audit readiness. Candidates should have significant experience in operational risk or internal audit, preferably with a banking or Big 4 background, and be comfortable working independently and communicating with senior stakeholders.
Must have
- 6–10 years in operational risk, internal audit, or a bank business risk and control unit
- Hands-on experience with risk registers, RCSA, KRIs and issue management
- Degree in Risk Management, Finance, Business, Information Systems or a related discipline
- Comfortable challenging senior people with data, and doing so fairly and consistently
- Strong analytical skills; able to work from raw data and spot when an answer does not add up
- Clear written and verbal communication, including presenting risk to leadership
- Works independently from day one with minimal supervision
- Familiarity with cybersecurity frameworks such as NIST CSF, ISO 27001, CREST and SOC-CMM
- Knowledge of Malaysian and regional regulatory expectations, such as BNM RMiT, NACSA and PDPA
- Experience with GRC or issue-tracking tools and dashboard reporting
Nice to have
- Big 4 risk advisory or banking background preferred
- BCP / BCM experience strongly preferred
- Exposure to cybersecurity, IT or managed services helpful, but not essential
- Certifications — Preferred: CISA, CRISC, CIA, an operational risk qualification, or CBCI. Good to have: ISO 27001 Lead Auditor, ISO 22301
Technologies
- Cybersecurity
- ISO 27001
- NIST
Highlights
Certifications such as CISA, CRISC, CIA, or CBCI are preferred, with ISO 27001 Lead Auditor and ISO 22301 considered good to have. Experience with business continuity planning and familiarity with regional regulatory expectations are advantageous.
Jobs across Sri Lanka, watched for you.Colombo, Sri Lanka