The Operational Risk Management (ORM) Senior Analyst serves as a senior individual contributor within the Second Line of Defense, supporting the ORM Manager through independent execution of complex operational risk activities. The role is responsible for leading risk assessments, performing credible challenge of First Line risk practices, translating operational risk data into actionable insights, and contributing to the ongoing enhancement of the Operational Risk Management Framework.

The ORM Senior Analyst demonstrates strong technical expertise, sound judgment, and the ability to influence stakeholders, while supporting the overall effectiveness of the ORM program.

Salary Range

The salary range for this position is $60.000 - $121,300 per year plus bonus. The base salary indicated for this position reflects the compensation range applicable to all levels of the role across the United States. Actual salary offers within this range may vary based on a number of factors, including the specific responsibilities of the position, the candidate’s relevant skills and professional experience, educational qualifications, and geographic location.

Key Accountabilities

Operational Risk Management

• Independently execute and support enhancements to core ORM programs, including Risk and Control Self-Assessments (RCSAs), Operational Loss Event Management, Control Monitoring and Testing, and Issue Management.
• Contribute to the development, refinement, and consistent application of ORM methodologies, procedures, tools, and reporting practices.
• Collaborate with First Line business groups and enterprise functions to assess and challenge operational risk considerations, support business liaison understanding of ORM expectations, and promote consistent application of operational risk practices across business continuity planning, third-party risk, change initiatives, and other activities with operational risk exposure.
• Apply effective Second Line challenge to First Line risk identification, control design, and remediation plans.
• Perform other operational risk management duties, special projects, and program initiatives as assigned to support evolving ORM priorities, regulatory expectations, and business needs.

Risk Assessments

• Lead risk assessments for assigned lines of business and facilitate RCSAs for Second Line enterprise functions in accordance with established ORM methodology, including identification of risks outside established risk appetite, tolerance, or expected control performance.
• Evaluate inherent risk, control effectiveness, and residual risk using established ORM rating methodologies and supporting evidence.
• Review and challenge First Line RCSA outputs and provide clear, risk-based feedback on assessment results, risk and control taxonomy alignment, control design, ratings, and supporting rationale.
• Document assessment results, including risk ratings, control evaluations, key observations, and agreed-upon remediation actions.
• Track ORM challenges and related management responses, validating closure evidence and completion of agreed-upon actions.
• Communicate assessment results, key themes, risk appetite or tolerance concerns, and escalation items to management and appropriate governance committees or forums. 

Control Monitoring, Testing, and Issue Management

• Execute independent control monitoring and targeted testing based on risk profiles, control performance, emerging issues, and ORM priorities.
• Analyze testing results, identify root causes or contributing factors, and recommend risk-based remediation actions, including escalation of control deficiencies into formal issues when warranted.
• Track remediation progress and escalate overdue or high-risk issues.
• Perform independent validation of issue remediation to confirm corrective actions effectively address identified risks, root causes, and intended outcomes.
• Monitor operational risk issue reporting, escalation, and timely remediation, ensuring appropriate follow-up with First Line owners.

Risk Reporting & Stakeholder Engagement

• Contribute to operational risk reports, dashboards, and governance materials for management and appropriate governance committees or forums.
• Develop risk reporting content that highlights trends, emerging risks, control weaknesses, key risk indicators, risk appetite measures, and recommended management actions.
• Support regulatory exams and internal audits related to operational risk, including information requests, audit or regulatory recommendation follow-up, issue follow-up, and management response support.
• Serve as a trusted risk partner to First Line stakeholders while maintaining Second Line independence and objective challenge.
• Escalate significant operational risk concerns, emerging themes, and unresolved issues to the ORM Manager or appropriate governance forum as warranted. 

Key Competencies for Position

• Independent Risk Judgment
• Second Line Influence and Objective Challenge
• Governance Reporting and Executive Communication
• Risk Analysis, Root Cause Evaluation, and Issue Validation
• Coaching and Knowledge Sharing

Qualifications and Education Requirements

• Bachelor’s degree in Business, Finance, Accounting, or a related field; operational risk, enterprise risk, audit, compliance, or banking-related certification preferred.
• 5+ years of experience in operational risk management, internal audit, compliance, enterprise risk management, or a related risk function, preferably within financial services.
• Strong understanding of regulatory expectations, operational risk frameworks, and effective Second Line oversight practices, including credible challenge, risk governance, and control effectiveness.
• Experience leading or materially supporting RCSAs, control testing, and issue management activities.
• Demonstrated ability to mentor junior staff, manage multiple priorities, and deliver high-quality work with limited supervision.
• Excellent written, verbal, presentation, collaboration, and interpersonal skills, with the ability to communicate complex operational risk concepts clearly, influence stakeholders, and solve problems in a risk-based manner.
• Proficiency with GRC systems, Microsoft Office tools, and data or reporting tools used to support operational risk analysis.