Position purpose: StoneX Group Inc. is seeking an experienced Senior Operational Risk Analyst to lead the program for all North America legal entities out of our Chicago office. Reporting to the Operational Risk Manager.
The Senior Operational Risk Analyst is responsible for supporting the execution and ongoing enhancement of the organization's Operational Risk Management framework. The role will have primary responsibilities across Risk and Control Self-Assessments (RCSAs), Incident Management, control testing, independent review and challenge, and operational risk governance and reporting.
The Senior Operational Risk Analyst will partner with business and functional stakeholders to identify and assess operational risks, evaluate the design and effectiveness of controls, analyze operational risk incidents, challenge risk assessments and remediation activities, and provide management with timely and meaningful risk information.
The role requires strong analytical skills, sound risk judgment, attention to detail, and the ability to translate risk information into actionable insights for business leaders, Risk Management, and governance committees.
Responsibilities
Primary duties will include:
Risk and Control Self-Assessments (RCSA)
- Coordinate and execute RCSA activities across assigned businesses and functions in accordance with the company's Operational Risk framework and methodology.
- Partner with business stakeholders to identify and assess key processes, operational risks, and controls.
- Facilitate RCSA workshops and risk discussions with business and functional stakeholders.
- Evaluate inherent risk, control effectiveness, residual risk, and alignment with established risk appetite and assessment criteria.
- Review the completeness and quality of risk and control documentation and supporting evidence.
- Provide independent review and challenge of business risk assessments, control evaluations, and residual risk conclusions.
- Identify inconsistencies, emerging risks, control weaknesses, and opportunities to strengthen the risk and control environment.
- Monitor RCSA remediation activities and ensure actions are appropriately documented and tracked through completion.
- Support ongoing enhancements to RCSA methodology, guidance, tools, and reporting.
Operational Risk Incident Management
- Support the identification, assessment, documentation, escalation, and reporting of operational risk incidents and losses.
- Partner with business owners to ensure incidents are recorded accurately, completely, and in a timely manner.
- Review incident classifications, risk taxonomy mapping, financial and non-financial impacts, root causes, control failures, and remediation actions.
- Facilitate or challenge root cause analysis for significant or recurring incidents.
- Assess whether incidents indicate broader control weaknesses, emerging risks, or potential systemic issues.
- Identify trends and recurring themes across incidents and provide recommendations for risk mitigation or enhanced controls.
- Monitor incident remediation activities through completion and challenge whether actions sufficiently address identified root causes.
- Support escalation of material incidents in accordance with established governance and reporting requirements.
- Assess whether incidents should trigger reassessment of related RCSA risks, controls, or other elements of the Operational Risk framework.
Control Testing & Assurance
- Plan, coordinate, and execute risk-based control testing in accordance with established control testing methodology and standards.
- Assess both the design and operating effectiveness of key controls.
- Define testing procedures, evidence requirements, sampling approaches, and evaluation criteria.
- Obtain and evaluate supporting evidence to determine whether controls are operating consistently and as designed.
- Maintain complete and defensible testing documentation, including testing procedures, evidence reviewed, exceptions identified, and conclusions reached.
- Clearly document identified control deficiencies and communicate results to relevant stakeholders.
- Work with control owners to develop appropriate remediation activities for identified deficiencies.
- Track remediation actions and perform or support validation activities prior to closure.
- Identify common control themes and systemic weaknesses across business areas and processes.
- Support enhancements to control testing methodology, procedures, documentation standards, and quality assurance.
Review & Challenge
- Provide objective and constructive second-line review and challenge of operational risk activities performed by the business.
- Challenge the appropriateness of risk ratings, control effectiveness assessments, remediation plans, risk acceptances, and closure conclusions.
- Evaluate whether risks have been identified and assessed consistently with the organization's risk taxonomy, methodology, and risk appetite.
- Review business-provided evidence to determine whether conclusions are adequately supported.
- Escalate material concerns, overdue actions, recurring control weaknesses, or areas outside risk appetite through appropriate governance channels.
- Document review and challenge activities to provide a clear record of the rationale, evidence, conclusions, and management responses.
- Balance effective challenge with constructive partnership to support sustainable improvements within the business.
Operational Risk Governance & Reporting
- Prepare regular Operational Risk reporting for senior management, risk committees, and other governance forums.
- Develop and maintain Key Risk Indicators (KRIs), Key Performance Indicators (KPIs), risk appetite metrics, dashboards, and other management information.
- Analyze data from RCSAs, incidents, control testing, issues, remediation activities, and other risk sources to identify trends and areas requiring management attention.
- Produce concise written analysis explaining significant risk movements, emerging trends, control weaknesses, and areas of heightened exposure.
- Monitor outstanding actions, overdue assessments, control deficiencies, incidents, and other Operational Risk deliverables.
- Support preparation of Operational Risk Committee materials and management presentations.
- Help ensure governance reporting is accurate, complete, timely, and supported by appropriate underlying data.
- Support periodic reporting to senior management and, where appropriate, Board-level risk governance forums.
Risk Identification, Data & Analytics
- Perform analysis across Operational Risk data to identify emerging risks, concentrations, recurring events, and control themes.
- Connect information across RCSAs, incidents, control testing, issues, audit findings, KRIs, and other risk information to develop a holistic view of Operational Risk exposure.
- Perform trend and thematic analysis to identify areas requiring further review or enhanced monitoring.
- Monitor changes in the business, operating environment, technology, regulatory landscape, and external events that could affect the organization's Operational Risk profile.
- Support development and enhancement of Operational Risk dashboards and analytical capabilities.
- Assist with data quality reviews and reconciliation of Operational Risk information.
Operational Risk Framework & Program Enhancement
- Support ongoing implementation and enhancement of the Operational Risk Management framework.
- Assist with development and maintenance of Operational Risk policies, standards, methodologies, procedures, and guidance.
- Identify opportunities to improve the efficiency, consistency, scalability, and effectiveness of Operational Risk processes.
- Support enhancements to Operational Risk systems, workflows, reporting, and automation.
- Participate in risk transformation and remediation initiatives.
- Support regulatory examinations, internal audits, compliance reviews, and other independent assessments relating to Operational Risk.
- Assist in demonstrating sustainable remediation of identified findings and control weaknesses.
Stakeholder Partnership
- Build effective working relationships with business leaders, risk owners, control owners, and other first- and second-line stakeholders.
- Provide guidance to the business regarding Operational Risk policies, methodologies, and expectations.
- Communicate risk findings clearly and constructively to stakeholders at different levels of the organization.
- Work collaboratively with related functions, including Compliance, Internal Controls, Information Security, Technology Risk, Third Party Risk Management, Business Resilience, and other risk disciplines.
- Promote strong risk ownership and reinforce business accountability for identifying and managing Operational Risk.
Qualifications
To land this role you will need:
- Relevant experience in Operational Risk, Enterprise Risk Management, Internal Controls, Audit, Compliance, or another risk and control discipline.
- Practical experience conducting or supporting RCSAs, risk assessments, control assessments, or similar risk management processes.
- Experience analyzing operational risk incidents, control failures, or risk events.
- Working knowledge of control design and operating effectiveness principles.
- Experience performing control testing, risk reviews, audit testing, or equivalent assurance activities.
- Demonstrated ability to critically evaluate information and provide effective review and challenge.
- Strong analytical, documentation, and problem-solving skills.
- Ability to analyze data, identify trends, and communicate meaningful risk insights.
- Strong written and verbal communication skills.
- Ability to manage multiple priorities and deadlines in a dynamic environment.
What makes you stand out:
- Experience within a financial services or other highly regulated environment.
- Experience within financial services or another highly regulated industry.
- Knowledge of operational risk management frameworks, risk taxonomies, risk appetite frameworks, and governance practices.
- Experience preparing Operational Risk reporting for senior management or risk committees.
- Experience with Governance, Risk and Compliance (GRC) platforms or Operational Risk technology.
- Experience participating in regulatory, internal audit, or independent assurance reviews.
- Advanced proficiency in Microsoft Excel and PowerPoint; experience with data visualization or analytics tools is advantageous.
Education / Certification Requirements:
- Bachelor's degree in Risk Management, Business, Finance, Accounting, Economics, or a related discipline, or equivalent professional experience.
Working Style:
- 4 days per week onsite, 1 day per week remote
Key Competencies
- Operational Risk Expertise - Understands core Operational Risk principles and can practically apply them through RCSAs, incident management, control testing, and governance processes.
- Risk Judgment - Demonstrates sound judgment when analyzing risk exposure, control effectiveness, residual risk, and remediation activities.
- Effective Review & Challenge - Constructively challenges business conclusions while maintaining productive stakeholder relationships.
- Analytical Thinking - Connects information across Operational Risk processes to identify trends, emerging risks, recurring control weaknesses, and broader themes.
- Control Mindset - Understands how controls mitigate risk and can determine whether controls are appropriately designed and operating effectively.
- Attention to Detail - Maintains accurate, complete, and defensible risk documentation capable of withstanding management, audit, and regulatory scrutiny.
- Communication & Influence - Explains complex risk matters clearly and appropriately to business stakeholders, Risk Management, and senior leadership.
- Execution & Accountability - Takes ownership of assigned deliverables, proactively manages deadlines, and follows risk matters through resolution.
- Continuous Improvement - Identifies opportunities to strengthen methodologies, processes, controls, data quality, reporting, and overall Operational Risk program maturity.
Hiring Salary Range $90,000 - $110,000. Salary to be determined by the education, experience, knowledge, skills and abilities of the applicant, internal equity and alignment with market data.) Subject to business performance and recommendations of management, this role may be eligible to participate in an incentive compensation plan. This compensation package, in addition to a full range of medical, financial, and/or other benef
