Process Risk and Compliance Operations Manager

Risk Strategy, Frameworks and AI Risk Governance

• Design and own the CS Risk Appetite Framework — define guardrails, escalation triggers, and pre-approved response actions. Requires continuous negotiation with senior leaders and cross-functional partners.
• Own and evolve the CS Risk Registry as a living strategic instrument. Challenge prioritization, validate risk scores, identify risks missed by automated systems, and ensure remediation accountability.
• Develop and stress-test risk assessment standards including key risk indicators (KRIs), risk typologies, and emerging threat hypotheses.
• Support the evolution of models and processes used in detection triage and investigation by interrogating model assumptions and sources of risk.
• Establish ongoing governance cadences — risk review boards, quarterly risk assessments, and challenge sessions.

Investigations Partnership and Strategic Oversight

• Collaborate closely with the Insider Threat Investigations team to ensure investigative outcomes are systematically captured, contextualized, and integrated into risk governance.
• Co-design escalation and review protocols for high-severity investigation findings and risk non-compliant transactions.
• Participate in joint case reviews, postmortems, and incident debriefs to extract systemic insights.
• Provide strategic risk context to the Investigations team to help prioritize investigative focus areas.
• Coordinate the feedback loop between investigations and AI-driven detection systems.

Root Cause Resolution Program Management

• Own the end-to-end lifecycle of root cause resolution — from identification through verified remediation and closure.
• Maintain and govern a centralized root cause and remediation tracker that captures all identified systemic issues, assigns ownership, defines milestones, and provides real-time visibility.
• Distinguish between symptomatic fixes and true root cause resolution. Challenge surface-level patches and advocate for structural solutions.
• Drive cross-functional remediation workstreams and hold workstream owners accountable through regular status reviews and executive escalation.
• Track resolution effectiveness over time and monitor whether implemented fixes reduce recurrence of underlying risk.
• Integrate root cause intelligence into the risk registry and risk appetite framework.
• Report on root cause resolution health to senior leadership.