RISK OFFICER / HEAD OF RISK – VARA-REGULATED VASP

ITSEC

Dubai

On-site

AED 300,000 - 520,000

Full time

7 days ago

Be an early applicant

Application generator

Turn this role into an interview — a resume and cover letter built around what this employer wants.

Get past ATS filters

Job summary

ITSEC in Dubai is seeking an experienced Risk Officer/Head of Risk to lead enterprise-wide risk management for a VARA-regulated VASP. The role focuses on developing and strengthening ERM, risk appetite, RCSA and KRIs while maintaining independence from business functions.

You will work with Compliance, IT, Finance and Operations to challenge risk exposures and report to the Board. Dubai-based, senior leadership role within a regulated digital asset environment.

Qualifications

Minimum 5+ years of risk management experience in banking, financial services, payments, FinTech or digital assets.
Strong knowledge of enterprise risk management, risk appetite, RCSA, KRIs, risk registers and board reporting.
Experience dealing with regulators, external auditors and senior stakeholders.

Responsibilities

Own the VASP's risk management framework and provide independent oversight of overall risk exposure.
Develop, implement and maintain the Enterprise Risk Management Framework (ERM) in line with VARA requirements.
Establish and review the Risk Appetite Framework and Risk Appetite Statement.
Maintain the Risk Register with ownership, inherent and residual risk, controls and escalation thresholds.
Define and monitor Key Risk Indicators (KRIs) and risk limits; report to Senior Management and the Board.
Conduct risk assessments across operational, market, liquidity, credit, custody, technology and outsourcing risks.
Establish third-party and outsourcing risk controls; ensure independence of the risk function.

Skills

Risk management

Regulatory knowledge

Stakeholder communication

Independent challenge

Education

Bachelor’s degree in Finance, Risk Management, Economics, Business, Accounting, Law

FRM/PRM/CFA/ICA (advantageous)

Job description

We are looking for an experienced Risk Officer / Head of Risk to join a VARA-regulated Virtual Asset Service Provider (VASP) in Dubai.

This is a senior risk management role requiring someone who understands that risk within a regulated virtual asset business goes far beyond maintaining a risk register.

The successful candidate will be responsible for building, maintaining and continuously strengthening the organisation’s enterprise-wide risk management framework across operational, financial, technology, cybersecurity, custody, counterparty, liquidity, market, outsourcing and regulatory risks.

THE ROLE

You will take ownership of the VASP’s risk management framework and provide independent oversight of the organisation’s overall risk exposure.

Key responsibilities will include:

Develop, implement and maintain the organisation’s Enterprise Risk Management Framework (ERM) in alignment with VARA requirements.
Establish and continuously review the organisation’s Risk Appetite Framework and Risk Appetite Statement.
Maintain the enterprise Risk Register, including risk ownership, inherent risk, controls, residual risk, mitigation actions and escalation thresholds.
Develop and operate Risk & Control Self-Assessment (RCSA) methodologies across business functions.
Define, monitor and report Key Risk Indicators (KRIs) and risk limits.
Prepare regular risk reporting and dashboards for Senior Management and the Board.
Provide independent challenge to business, operational and technology teams regarding material risk exposures.
Conduct risk assessments relating to:

Operational risk
Market risk
Liquidity risk
Credit and counterparty risk
Custody and safeguarding risk
Wallet and private-key management risk
Technology and cybersecurity risk
Information security risk
Third-party and outsourcing risk
Business continuity and operational resilience
Fraud risk
Concentration risk
Client asset risk
New product and service risk
Regulatory and compliance-related risk

Conduct New Product Risk Assessments before the introduction of new virtual assets, products, services, counterparties or material changes to the operating model.
Review risks associated with exchanges, liquidity providers, custodians, banking partners, technology providers and other critical third parties.
Establish appropriate third-party and outsourcing risk management controls, including due diligence, risk classification and ongoing monitoring.
Work closely with Compliance, MLRO, Information Security, Technology, Finance, Operations and Senior Management while maintaining the independence of the risk function.
Support the development and testing of Business Continuity, Disaster Recovery and Operational Resilience arrangements.
Participate in scenario analysis, stress testing and assessment of severe but plausible risk events.
Establish appropriate processes for risk incidents, breaches, control failures, root-cause analysis, remediation tracking and escalation.
Assess emerging risks arising from virtual assets, blockchain infrastructure, smart contracts, custody models, DeFi exposure, APIs and digital-asset market infrastructure.
Ensure material risks and breaches are escalated appropriately to Senior Management and the Board.
Support regulatory examinations, audits, supervisory reviews and information requests relating to risk management.
Maintain appropriate documentation and evidence demonstrating the effective operation of the risk management framework.
Monitor changes to the regulatory environment and evaluate their impact on the organisation’s risk profile.

VARA & REGULATORY KNOWLEDGE

The ideal candidate should have a strong working understanding of the VARA regulatory framework, particularly:

VARA Compliance and Risk Management Rulebook
VARA Company Rulebook
VARA Technology and Information Rulebook
VARA Market Conduct Rulebook
Relevant activity-specific VARA Rulebooks
UAE AML/CFT regulatory environment
Governance and Board reporting requirements
Operational resilience and business continuity
Technology and cybersecurity risk
Virtual asset custody and safeguarding arrangements

Previous direct experience working within a VARA-regulated VASP or VARA licensing environment is highly preferred.

EXPERIENCE & QUALIFICATIONS

We are looking for candidates with:

Minimum 5+ years of relevant risk management experience, preferably within banking, financial services, payments, FinTech, digital assets or virtual assets.
Strong preference for candidates with direct experience in virtual assets, crypto exchanges, custody, brokerage, payments or regulated FinTech.
Experience developing and operating enterprise risk management frameworks.
Strong knowledge of risk appetite, RCSA, KRIs, risk registers, incident management and Board-level risk reporting.
Experience dealing with regulators, external auditors, internal auditors and senior stakeholders.
Strong understanding of the Three Lines Model and independence of the risk function.
Ability to translate regulatory requirements into practical controls and operating procedures.
Strong analytical, documentation and communication skills.
Ability to independently challenge Senior Management and business functions when required.
Bachelor’s degree in Finance, Risk Management, Economics, Business, Accounting, Law or a related discipline.
Professional qualifications such as FRM, PRM, CFA, ICA or equivalent would be advantageous but are not mandatory.