Head of Operational Risk (Banking)

In brief

**Overview** This permanent, full-time Head of Operational Risk (Banking) position is offered by a banking client of Talent Candey, based in Somerset West, South Africa. It is an Employment Equity (EE) designated role within the Enterprise Risk division, reporting directly to the Chief Risk Officer (CRO). The successful candidate will serve as the second line-of-defence owner for the bank’s operational risk management function. The role currently has no direct reports, but the Head of Operational Risk will be responsible for building the team as required. The primary purpose is to own the design, implementation, and ongoing effectiveness of the bank’s Operational Risk and Resilience Management Framework (ORRMF). This framework encompasses risks from processes, products, people, fraud, legal matters, financial reporting and tax, physical security, third parties, data, IT (including cyber), and models, requiring coordination with specialist functions like Fraud and Legal. As the bank is a new entrant to the retail banking market, it requires a proportionate, scalable operational risk framework built from inception, covering risk and control self-assessment, loss event management, business continuity and resilience, and third-party and outsourcing risk, to ensure operational stability for the Board and Executive Committee (Exco) as the bank scales. **What you will do** Key responsibilities include: * **Framework Design and Risk Appetite:** * Designing, implementing, and maintaining the bank’s Operational Risk and Resilience Management Framework (ORRMF). * Setting and recommending operational risk appetite for Board approval, along with supporting metrics. * Monitoring performance against the approved risk appetite and metrics. * **Risk Assessment, Loss Events and Control Monitoring:** * Leading the bank’s risk and control self-assessment (RCSA) process across business units. * Identifying key risks and testing the design and operation of associated controls. * Owning the operational loss event and near-miss management process. * Conducting root-cause analysis, producing thematic reporting, and tracking remediation actions through to closure. * Independently testing and challenging first-line operational controls across channels, payments, and product teams. * **Resilience, Business Continuity and Third-Party Risk:** * Owning the bank’s business continuity management (BCM) and operational resilience management. * Overseeing business impact analyses, recovery planning, and periodic testing. * Designing and overseeing third-party and outsourcing risk management. * Working with Procurement and Legal on risk assessments, contractual risk clauses, and ongoing vendor risk monitoring. * Coordinating with Technology and Cyber Risk functions to ensure operational risk oversight appropriately covers IT and cyber-related operational risk without duplicating specialist technology risk coverage. * **Governance, Reporting and Regulatory Engagement:** * Preparing operational risk dashboards, RCSA outcomes, and loss event reporting for Exco, the Board Risk Committee, and relevant Board sub-committees. * Escalating material risk events and control breaches. * Supporting the bank’s readiness for Prudential Authority inspections and thematic reviews relating to operational risk and resilience. * Coordinating with the Head of FRAML, Head of FCC, Head of Regulatory Compliance, Head of Conduct and POPIA, and Internal Audit to ensure coherent, non-duplicative coverage of the bank’s overall risk and compliance universe. * **Culture, Capability and Stakeholder Management:** * Championing a proactive operational risk culture across the bank. * Embedding risk ownership within the first line, ensuring operational risk is understood as a shared responsibility. * Designing and rolling out operational risk training and awareness programmes in partnership with Compliance and HR. * Building and leading a capable operational risk team as the bank scales. * Overseeing recruitment, coaching, and succession planning within the function. **Requirements (from the original advert)** * **Qualifications:** * Bachelor’s degree in Risk Management, Finance, Actuarial Science, Commerce or a related field. * A postgraduate qualification will be advantageous. * Risk certification such as FRM, PRM or a recognised operational risk management qualification is strongly preferred. * **Experience:** * A minimum of 10–12 years’ experience in operational risk management, including at least 5 years in a senior leadership role within a bank or other regulated financial institution. * Demonstrated experience designing or materially uplifting an operational risk and resilience management framework. * Experience within a greenfield, scale-up or newly licensed institution will be advantageous. * Practical experience with RCSA methodology. * Practical experience in loss event and incident management. * Practical experience in business continuity management. * Experience engaging with the Prudential Authority on operational risk and resilience matters. * **Skills and Knowledge:** * Deep technical knowledge of operational risk management frameworks, RCSA methodology and Basel operational risk capital requirements. * Strong understanding of business continuity management and operational resilience practices relevant to South African retail banking. * Ability to build pragmatic, proportionate frameworks suited to a new entrant, avoiding unnecessary legacy-bank complexity. * Confident Board- and Exco-level reporting and stakeholder engagement. * Strong people leadership skills, with the ability to build a function from a small base. * **Regulatory and Governance Knowledge:** * Maintain current working knowledge of: * Banks Act 94 of 1990 and Regulations relating to Banks, including operational risk capital requirements under the Basel-aligned standardised approach. * Prudential Authority directives and guidance notes relating to operational risk management and operational resilience. * King IV Report on Corporate Governance, particularly the principles relating to risk governance and combined assurance. * Protection of Personal Information Act (POPIA), insofar as operational risk incidents may involve personal information, coordinated with the Head of Conduct and POPIA. * National Payment System Act 78 of 1998, insofar as it relates to operational risk in payment processes. **Who should apply** The ideal candidate is an experienced Head of Operational Risk with a minimum of 10-12 years in the field, including at least 5 years in a senior leadership role within a regulated financial institution, preferably a bank. This individual should possess a Bachelor’s degree in a relevant field, with a postgraduate qualification and risk certification being advantageous and strongly preferred, respectively. They must be an Employment Equity (EE) candidate and possess demonstrated experience in designing or materially uplifting an operational risk and resilience management framework, ideally within a greenfield, scale-up, or newly licensed institution. Practical experience with RCSA methodology, loss event/incident management, business continuity management, and engaging with the Prudential Authority is essential. The candidate should have deep technical and regulatory knowledge of operational risk management, Basel requirements, and South African retail banking practices. Strong leadership skills, the ability to build a function from scratch, and confident Board- and Exco-level reporting and stakeholder engagement are crucial for this role, as is the ability to champion a proactive operational risk culture. **Deadline** Not specified **Reference** Original posting: https://www.jobmail.co.za/jobs/finance-accounting/finance-accounting-management/somerset-west/head-of-operational-risk-banking-id-7599838 Source: jobmail

Summary drafted with AI assistance from the original advert. The advert itself is the authority — how we use AI.

At a glance

• At least 10 years of experience.

Extracted automatically from the advert; confirm requirements on the original listing.

Job description

Before you apply

• Confirm the requirements and closing date on the original listing (jobmail). SPANi lists vacancies from other sites and may not reflect last-minute changes.
• Legitimate employers do not charge application, registration or training fees.
• Don't send your ID or bank details before you have confirmed the employer is real.

How to spot a job scam

Applying for permanent roles

• Mirror the job title and top three requirements in your CV summary and most recent experience.
• Quantify results where possible: sales targets, cases handled, tickets closed, or team size.
• Proofread contact details and filenames before submitting — small errors cost interviews.
• Verify the company and role on the source page before sharing ID copies or banking details.