The posting
We are a leading trading platform that is ambitiously expanding to the four corners of the globe. Our top-rated products have won prestigious industry awards for their cutting-edge technology and seamless client experience. We deliver only the best, so we are always in search of the best people to join our ever-growing talented team.
As Senior Operational Risk Analyst, you will be a core member of Capital.com's risk function, reporting to the Head of Risk Management. You will run the operational risk cycle across the Group's Cyprus-regulated investment firms: the risk register, the business-wide risk assessment, the RCSA, the operational risk event register, and relevant reporting. ICT and digital operational resilience under DORA sit alongside that work, with framework direction and regulatory sign-off set by the Head of Risk.
Responsibilities:
- Operational Risk Framework and RCSA: Run the risk register, business-wide risk assessment and risk and control self-assessment cycles for each entity: collect and challenge first-line input, score likelihood and impact, assess control effectiveness, and carry each risk from inherent through to residual.
- Operational Risk Event Management: Maintain the operational risk event register: capture and classify events against the risk taxonomy, complete root-cause analysis, identify repeat patterns, and track first-line remediation through to closure.
- Operational Risk Reporting: Produce the monthly operational risk event report and the operational risk sections of the Risk Committee pack. Monitor key risk indicators against stated appetite and flag adverse trends before a threshold is reached.
- ICARA Contribution: Provide the operational risk input to the ICARA for each entity: loss data, scenario analysis, and the operational risk element of the additional own funds and liquidity assessment.
- Control Assessment and Testing: Test whether controls work rather than whether they exist: query platform and warehouse data directly to evidence risk positions, assess control performance, and substantiate event impact instead of relying on first-line summaries.
- DORA and ICT Resilience: Support delivery of the DORA programme across each regulated entity: maintain the ICT risk management artefacts, prepare the material for the ICT risk workstream, and track remediation actions through to closure, under the direction of the Head of Risk.
- ICT Incident Classification and Reporting: Prepare major-incident assessments against the DORA classification criteria.
- CT Third-Party and Outsourcing Risk: Carry out vendor and outsourcing risk assessments, prepare critical-or-important-function assessments, and track concentration across ICT service providers.
- Assurance Support: Prepare responses to internal audit findings, external readiness reviews and supervisory observations, assemble the supporting evidence, and track action dates with the owners.
- Cross-Functional Coordination: Work closely with Operations, Technology, Information Security, Compliance, Legal and Finance so that risk outputs land in the governance process and escalate on the right trigger.
Requirements:
- At least 3 years in risk management within a regulated financial services environment, with a material part of it in operational risk: investment firm, bank, payment institution, or a consulting or audit practice serving them.
- Hands-on experience running operational risk framework cycles, including the risk register, business-wide risk assessment and RCSA, with likelihood and impact scoring, control effectiveness assessment and the inherent-to-residual step.
- Experience managing an operational risk event register: capture, classification against a taxonomy, root-cause analysis, and remediation tracking with first-line owners.
- Experience producing operational risk reporting and governance deliverables that reach a committee, a board or a supervisor, including key risk indicators measured against stated appetite, and readiness to own them as you grow into the role.
- Working knowledge of DORA (Regulation (EU) 2022/2554), with exposure to at least one area: ICT risk management artefacts, incident classification and reporting, ICT third-party risk and the register of information, or resilience testing.
- An organised approach to tracking regulatory developments across CySEC, ESMA and the EBA, and the ability to set out what a new rule means for the firm.
- A degree in a numerate discipline: economics, finance, mathematics, engineering or similar. CySEC Advanced certification, or willingness to obtain it, is an advantage, as is an operational risk, operational resilience or information security certification.
What you will get in return:
• Competitive Salary: We believe great work deserves great pay! Your skills and talents will be rewarded with a salary that makes you feel valued and motivated.
• Work-Life Harmony: Join a company that genuinely cares about you - because your life outside of work matters just as much as your time on the clock. #LI-Hybrid
• Generous Time Off: Need a breather? Our annual leave policy lets you recharge and enjoy life outside of work without a worry.
• Employee Referral Program: Love working here? Share the love! Bring your talented friends on board and get rewarded for growing our awesome team.
• Comprehensive Health & Pension Benefits: From medical insurance to pension plans, we’ve got your back. Plus, location-specific benefits and perks!
• Workation Wonderland: Live your digital nomad dreams with 30 extra days to work remotely from anywhere in the world (some restrictions apply). Adventure awaits!
• Volunteer Days: Make a difference! Take two additional paid days each year to support causes you care about and give back to the community.
Be a key player at the forefront of the digital assets movement, propelling your career to new heights! Join a dynamic and rapidly expanding company that values and rewards talent, initiative, and creativity. Work alongside one of the most brilliant teams in the industry.
