Head of Risk – EU

OSL; Österreich; Vor Ort; EUR 140.000 - 210.000; Vollzeit

Zusammenfassung

OSL in Austria is seeking a Head of Risk to own risk management end-to-end as the firm builds its licensed European crypto platform.

You will inherit a strong policy framework, lead the risk function locally, and chair governance bodies while aligning with MiCAR and DORA requirements.

This role demands autonomous leadership, deep crypto risk expertise, and the ability to translate policy into audit-ready controls that protect client assets and the business.

Qualifikationen

• 7–10 years in risk management, including leadership at head or senior level.
• Strong working knowledge of MiCAR and DORA and how CASP risk obligations translate into a live framework.
• Ability to define good practice in this domain and operate autonomously.
• Deep understanding of crypto-asset risk: custody, on-chain settlement, market and liquidity risk.
• Track record of building or reshaping a risk framework, not just operating an existing one.
• Experience with third-party and outsourcing risk, operational resilience and business continuity.
• Comfortable giving independent challenge to first-line functions and regulators.
• Clear, plain communication with data to inform board decisions.
• Fluency in English; German is a plus.

Aufgaben

• Own the enterprise risk management framework, risk appetite, policies, and governance aligned with group risk.
• Lead the implementation and enhancement of risk standards and governance; maintain risk assessment and registers.
• Chair the local risk governance bodies and participate in executive meetings for risk-informed decisions.
• Set and monitor risk limits and indicators across custody, transfers, fiat rails, trading and OTC.
• Own third-party and outsourcing risk framework and ICT risk with the DORA officer and Tech teams.
• Oversee operational resilience framework, BIA, scenario analysis, and disaster recovery oversight.
• Provide independent second-line challenge and support audits and regulatory examinations.
• Lead risk reporting to Management Board, group, and regulator; inform capital and prudential input.
• Sign-off risk assessments for new products, assets, and partners; build the risk team as the entity grows.

Kenntnisse

Risk leadership

Regulatory frameworks

MiCAR

DORA

Crypto risk

Stakeholder management

Regulatory reporting

Data-driven decisions

Jobbeschreibung

This is a rare chance to own risk end to end at the birth of a regulated European crypto entity, with the autonomy to build the function your way and the backing of an established, publicly listed global group. We are looking for a Head of Risk to take full ownership of risk management at our newly licensed Austrian entity, across custody, on-chain transfers, fiat on and off-ramp, spot trading and the OTC desk.

You will own the risk function end to end. The framework, the risk appetite the board signs off on, the enterprise risk assessment, and the limits and indicators the business runs against day to day. You will not be starting from a blank page. You will inherit a strong policy framework and the backing of an established global risk function, and take local ownership, turning documented policies into a live, operating, audit-ready risk environment. The work spans the risks of holding and moving crypto, custody, key management and on-chain settlement, and the market, liquidity and counterparty risk that come with trading and OTC, alongside the operational resilience and third-party risk that DORA puts front and centre.

You will act as the independent second-line voice in the entity, working across Operations, Technology & Security, Trading and Finance, and alongside Compliance, the AMLO and the DORA officer, giving challenge without owning what they run. The B2B model shapes all of it. You will report risk to the Management Board and the group in terms people can act on, be a steady voice in front of the FMA, and build the risk team as the entity scales toward its full operating model.

Key Responsibilities

• Own the enterprise risk management framework. The risk taxonomy, the risk appetite statement and the policies beneath them, aligned with group risk appetite and sized to a MiCAR CASP and the firm's B2B model, and set the strategic direction for operational risk management locally.
• Lead the implementation and continuous enhancement of risk standards, frameworks and governance, turning the inherited policies into live, operating processes, running the enterprise risk assessment and the risk registers, and keeping them current as regulation, products and the business change.
• Chair the local risk governance bodies, including the OSL EU Risk Committee and its sub-committees, and sit as a core participant in executive management meetings so strategic decisions are risk-informed.
• Set and monitor risk limits and key indicators across custody, transfers, fiat rails, spot trading and OTC, covering market, liquidity, credit and counterparty exposure on the trading book.
• Own the third-party and outsourcing risk framework. Risk-based due diligence, criticality assessment, ongoing monitoring and exit planning, working with the DORA officer on ICT-specific requirements and with Technology & Security on ICT concentration and exit risk.
• Own the operational resilience framework, including the business impact analysis, scenario analysis and independent oversight of business continuity and disaster recovery, alongside the functions that operate them.
• Provide independent second-line challenge of first-line risk taking, including the information security and ICT incident picture, and support internal and external audits and regulatory examinations.
• Lead the reporting and presentation of risk status, trends and key developments to the Management Board, the group and the FMA, and provide risk input to capital and prudential assessments led by Finance.
• Provide risk assessment and sign-off for new products, new crypto-assets and new B2B2X partners, so the business grows inside its stated risk appetite.
• Build, develop and lead the risk team as the entity scales.

Requirements

• 7–10 years in risk management, including leadership at Head or senior level, ideally in regulated financial services or a crypto-asset business.
• Strong working knowledge of MiCAR and DORA, and how a CASP's risk obligations turn into a framework that actually runs.
• Able to define what good looks like in this domain and operate autonomously, setting the standard rather than waiting for direction.
• Real understanding of crypto-asset risk. Custody and key management, on-chain settlement, and the market, liquidity and counterparty risk that come with trading and OTC.
• Track record of building or substantially reshaping a risk framework, not only operating one that already exists.
• Experience with third-party and outsourcing risk, and with operational resilience and business continuity under a regulatory lens.
• Comfortable giving independent challenge to first-line functions and senior stakeholders, and credible in front of a regulator.
• Strong process and documentation discipline, able to turn a policy framework into demonstrable, audit-ready controls.
• Experience in a B2B or institutional setting, where relationships are fewer, larger and more complex than in retail.
• Clear, plain communicator, strong with data, who turns risk into decisions the board and the business will use.
• Fluency in English is required; German is an advantage.

Why this role

Few roles offer this mix: the autonomy of building and running a risk function yourself, the safety of an established global group behind you, and the challenge of getting risk right for a regulated crypto platform from day one. You will take local ownership of a strong framework, sharpen the limits and controls that protect client assets and the firm, and build the risk function the whole business leans on. MiCAR is still young, and few people have stood up and run risk for a licensed CASP. If you are a senior risk leader who wants genuine ownership, a regulated environment worth getting right, and the chance to build a high-performing team from the start, we would like to hear from you.

Vision & Mission

• OSL is the first SFC-licensed digital asset platform in Hong Kong and a PayFi innovator. Through stablecoin payments, cross-border settlement and global licensing, we are building the next-generation payments network. Stablecoins have become everyday money across emerging markets and are widely viewed as blockchain’s “killer app,” with industry focus shifting from token issuance to real-world consumer and enterprise payment adoption. The strongest growth lies in cross-border B2B payments, where providers embedding stablecoins into corporate settlement flows can capture significant volume and float. Long-term defensibility comes from regulatory licences, banking partners and cross-border corridors.
• OSL holds or has acquired licences in Hong Kong, Japan, Australia, Bermuda and Indonesia, and is expanding into Europe, Brazil, Southeast Asia and Africa through acquisitions and licence applications. With OSL Pay and StableX, we embed stablecoin settlement into bank accounts and card networks, support 150+ digital assets, and provide 24/7 fiat–stablecoin conversion. As a regulated pioneer with a startup mindset, we believe the future of payments will be driven by real adoption and scalable deployment, not technology narratives. We welcome builders who are passionate about crypto and payments to join us in shaping compliant, global payment infrastructure.