Senior Operational Risk Analyst

As Senior Operational Risk Analyst, you will be a core member of Capital.com's risk function, reporting to the Head of Risk Management. You will run the operational risk cycle across the Group's Cyprus-regulated investment firms: the risk register, the business-wide risk assessment, the RCSA, the operational risk event register, and relevant reporting. ICT and digital operational resilience under DORA sit alongside that work, with framework direction and regulatory sign-off set by the Head of Risk.

Responsibilities:

• Operational Risk Framework and RCSA: Run the risk register, business-wide risk assessment and risk and control self-assessment cycles for each entity: collect and challenge first-line input, score likelihood and impact, assess control effectiveness, and carry each risk from inherent through to residual.
• Operational Risk Event Management: Maintain the operational risk event register: capture and classify events against the risk taxonomy, complete root-cause analysis, identify repeat patterns, and track first-line remediation through to closure.
• Operational Risk Reporting: Produce the monthly operational risk event report and the operational risk sections of the Risk Committee pack. Monitor key risk indicators against stated appetite and flag adverse trends before a threshold is reached.
• ICARA Contribution: Provide the operational risk input to the ICARA for each entity: loss data, scenario analysis, and the operational risk element of the additional own funds and liquidity assessment.
• Control Assessment and Testing: Test whether controls work rather than whether they exist: query platform and warehouse data directly to evidence risk positions, assess control performance, and substantiate event impact instead of relying on first-line summaries.
• DORA and ICT Resilience: Support delivery of the DORA programme across each regulated entity: maintain the ICT risk management artefacts, prepare the material for the ICT risk workstream, and track remediation actions through to closure, under the direction of the Head of Risk.
• ICT Incident Classification and Reporting: Prepare major-incident assessments against the DORA classification criteria.
• CT Third-Party and Outsourcing Risk: Carry out vendor and outsourcing risk assessments, prepare critical-or-important-function assessments, and track concentration across ICT service providers.
• Assurance Support: Prepare responses to internal audit findings, external readiness reviews and supervisory observations, assemble the supporting evidence, and track action dates with the owners.
• Cross-Functional Coordination: Work closely with Operations, Technology, Information Security, Compliance, Legal and Finance so that risk outputs land in the governance process and escalate on the right trigger.

Requirements:

• At least 3 years in risk management within a regulated financial services environment, with a material part of it in operational risk: investment firm, bank, payment institution, or a consulting or audit practice serving them.
• Hands-on experience running operational risk framework cycles, including the risk register, business-wide risk assessment and RCSA, with likelihood and impact scoring, control effectiveness assessment and the inherent-to-residual step.
• Experience managing an operational risk event register: capture, classification against a taxonomy, root-cause analysis, and remediation tracking with first-line owners.
• Experience producing operational risk reporting and governance deliverables that reach a committee, a board or a supervisor, including key risk indicators measured against stated appetite, and readiness to own them as you grow into the role.
• Working knowledge of DORA (Regulation (EU) 2022/2554), with exposure to at least one area: ICT risk management artefacts, incident classification and reporting, ICT third-party risk and the register of information, or resilience testing.
• An organised approach to tracking regulatory developments across CySEC, ESMA and the EBA, and the ability to set out what a new rule means for the firm.
• A degree in a numerate discipline: economics, finance, mathematics, engineering or similar. CySEC Advanced certification, or willingness to obtain it, is an advantage, as is an operational risk, operational resilience or information security certification.