The posting
Lightspark is creating the Money Grid, modern, open financial infrastructure that makes payments accessible, affordable, and instant for businesses and users worldwide. We're challenging the status quo, updating the current system, and empowering our partners to build better solutions. Together, we're building the most advanced financial infrastructure, open, instant, and global, inspiring a future where anyone, anywhere can access the full potential of digital money.
We are looking for a Risk Manager to lead the risk management function of Lightspark’s Estonian regulated entity, an e-money institution and crypto-asset service provider. The role will be responsible for building out and running a risk framework that keeps pace with a fast-growing business, covering everything from risk appetite and key risk indicators to ICT risk, business continuity and the safeguarding of client funds. You will work closely with the Management Board, the Supervisory Board and teams across the business, giving practical risk guidance that supports sustainable growth with a risk based methodology applied to new business. If you enjoy building structure from the ground up, want real ownership of a second-line function and are interested in stable coins, card payments and embedded finance, this is a good opportunity to make a real difference.
As the Risk Manager, you will report to a member of the Management Board and own the company’s risk management framework end to end. Your work will cover the risk appetite statement and its reporting, risk and control registers, key risk indicators, company-wide risk assessments, fraud risk, ICT and security risk under DORA, business continuity, third-party risk and oversight of finance-related risks such as own funds and safeguarding. You will also lead our risk-related supervisory reporting, prepare the company for supervisory reviews and build risk awareness across the organization. This is a second-line role where independent judgement and the ability to turn regulation into working processes matter equally.
WHAT YOU'LL DO
- Own and develop the risk management policies and procedures, including their annual review and the risk-related processes embedded in other company policies.
- Map the company’s key risks to first-line owners, define measurable and collectible key risk indicators and set up ongoing risk monitoring.
- Build and maintain the risk and control register, with a documented annual review cycle.
- Finalize and run the Risk Appetite Statement, including mapping data sources, populating the reporting form and reporting quarterly to the Management Board and the Supervisory Board for approval.
- Lead company-wide risk assessments, including for new products, business lines and material changes.
- Develop card payment fraud risk processes together with Operations, building on the existing fraud risk policy.
- Lead ICT and security risk management in line with DORA, including the ICT risk register, ICT and information asset registers and the vendor register, and deliver the ICT risk work plan.
- Own business continuity management, keeping the business impact analysis and business continuity plan current as new business lines, processes and vendors are added, and run incident management walkthroughs and tabletop exercises with the group information security team.
- Manage ICT third-party risk, including reviewing vendor agreements against DORA requirements and preparing the register of information for supervisory reporting.
- Lead risk-related supervisory reporting, including operational risk and DORA reporting, and prepare the company for supervisory inspections, including on ICT risk management and crypto-asset custody.
- Oversee finance-related risks, including periodic own funds calculations and projections, secure and highly automated safeguarding account flows without single-person access, and reporting obligations to stablecoin issuer partners.
- Prepare clear risk management reports for the Management Board and the Supervisory Board.
- Build a culture of risk awareness, including running the annual risk training and internal workshops.
- Work with Compliance, AML, Legal, Operations, Product, Engineering and Finance to build risk management into daily operations.
WHAT WE ARE LOOKING FOR
- 3+ years of experience in risk management at a credit institution, e-money institution, payment institution, investment firm or crypto-asset service provider, or equivalent experience in the financial sector or at a public authority.
- Ideally, experience in working closely with and/or co-ordinating communication with the Estonian FSA
- University degree in finance, economics, business, law or a comparable field preferred.
- Solid knowledge of EU and Estonian risk management regulation and guidelines, including DORA, the relevant EBA guidelines on internal governance, ICT and security risk and outsourcing, and the own funds and safeguarding requirements under EMD and PSD2.
- Hands-on experience building risk frameworks, such as risk appetite statements, key risk indicators, risk and control registers, business impact analyses and business continuity plans.
- A good understanding of ICT risk, information security and third-party risk management.
- Strong project management skills and a structured way of working, with the ability to run several workstreams against regulatory deadlines.
- A proactive attitude and the independence to operate as a second-line function, proposing initiatives and developing new ideas on your own.
- Good communication skills, with the ability to present risk matters to the Management Board and Supervisory Board and explain them in practical terms to non-risk audiences.
- Knowledge of virtual assets and blockchain technology, crypto-asset custody, card payments and fraud, AML/CFT and sanctions, data protection, or embedded finance and banking-as-a-service setups is a plus.
- Working proficiency in Estonian and English.
- On-site 5 days, Full time, permanent.
COMPENSATION
The gross monthly base salary range for this role is €4,400 – €5,170. The final offer will depend on experience and skills, and is determined using objective, gender-neutral criteria. You will also be eligible for an annual performance bonus and equity.
Lightspark is on a mission to build the future of open, instant, and global financial infrastructure making payments accessible and affordable for everyone, everywhere. We're committed to creating a more inclusive and diverse workplace to reflect the customers we serve. We welcome interest from individuals of all backgrounds and levels of experience who share our mission. We do not discriminate based on race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, disability status, or other applicable legally protected characteristics.
For US Applicants:
We will consider for employment qualified applicants with criminal histories in a manner consistent with the requirements of the State of California Fair Chance Initiative for Hiring.
For EU Applicants:
In accordance with applicable EU and local regulations, including the Estonian Employment Contracts Act, Equal Treatment Act, and Gender Equality Act, Lightspark ensures equal treatment throughout the hiring process.
