Senior Operational Risk Analyst
As Senior Operational Risk Analyst, you will be a core member of Capital.com's risk function, reporting to the Head of Risk Management. You will run the operational risk cycle across the Group's Cyprus-regulated investment firms: the risk register, the business-wide risk assessment, the RCSA, the operational risk event register, and relevant reporting. ICT and digital operational resilience under DORA sit alongside that work, with framework direction and regulatory sign-off set by the Head of Risk.
Operational Risk Framework and RCSA: Run the risk register, business-wide risk assessment and risk and control self-assessment cycles for each entity: collect and challenge first-line input, score likelihood and impact, assess control effectiveness, and carry each risk from inherent through to residual.
Operational Risk Event Management: Maintain the operational risk event register: capture and classify events against the risk taxonomy, complete root-cause analysis, identify repeat patterns, and track first-line remediation through to closure.
Operational Risk Reporting: Produce the monthly operational risk event report and the operational risk sections of the Risk Committee pack. Monitor key risk indicators against stated appetite and flag adverse trends before a threshold is reached.
ICARA Contribution: Provide the operational risk input to the ICARA for each entity: loss data, scenario analysis, and the operational risk element of the additional own funds and liquidity assessment.
Control Assessment and Testing: Test whether controls work rather than whether they exist: query platform and warehouse data directly to evidence risk positions, assess control performance, and substantiate event impact instead of relying on first-line summaries.
DORA and ICT Resilience: Support delivery of the DORA programme across each regulated entity: maintain the ICT risk management artefacts, prepare the material for the ICT risk workstream, and track remediation actions through to closure, under the direction of the Head of Risk.
ICT Incident Classification and Reporting: Prepare major-incident assessments against the DORA classification criteria.
CT Third-Party and Outsourcing Risk: Carry out vendor and outsourcing risk assessments, prepare critical-or-important-function assessments, and track concentration across ICT service providers.
Assurance Support: Prepare responses to internal audit findings, external readiness reviews and supervisory observations, assemble the supporting evidence, and track action dates with the owners.
Cross-Functional Coordination: Work closely with Operations, Technology, Information Security, Compliance, Legal and Finance so that risk outputs land in the governance process and escalate on the right trigger.
At least 3 years in risk management within a regulated financial services environment, with a material part of it in operational risk: investment firm, bank, payment institution, or a consulting or audit practice serving them.
Hands-on experience running operational risk framework cycles, including the risk register, business-wide risk assessment and RCSA, with likelihood and impact scoring, control effectiveness assessment and the inherent-to-residual step.
Experience managing an operational risk event register: capture, classification against a taxonomy, root-cause analysis, and remediation tracking with first-line owners.
Experience producing operational risk reporting and governance deliverables that reach a committee, a board or a supervisor, including key risk indicators measured against stated appetite, and readiness to own them as you grow into the role.
Working knowledge of DORA (Regulation (EU) 2022/2554), with exposure to at least one area: ICT risk management artefacts, incident classification and reporting, ICT third-party risk and the register of information, or resilience testing.
An organised approach to tracking regulatory developments across CySEC, ESMA and the EBA, and the ability to set out what a new rule means for the firm.
A degree in a numerate discipline: economics, finance, mathematics, engineering or similar. CySEC Advanced certification, or willingness to obtain it, is an advantage, as is an operational risk, operational resilience or information security certification.
