Senior Director, Non-Financial Risk Management

Optus; Melbourne; Hybrid; AUD 260,000 - 380,000; Full time

Benefits offered by this job

Flexible working arrangements

Parental Leave

Counselling services

Job summary

Optus is seeking an experienced Senior Director of Non-Financial Risk Management to establish enterprise standards and lead the end-to-end RCSA program, incidents, issues, and resilience across technology, cyber, network and regulatory domains. The role partners with executive teams to drive risk visibility and disciplined remediation.

This senior leadership position reports into the EGM, Integrated Risk and Controls Management, and focuses on translating risk policies into practical,

Qualifications

• 15+ years’ experience in non-financial risk, operational risk, risk frameworks or controls within a large, complex organisation.
• Deep expertise with RCSA, risk acceptance, incidents, issues management and control assessment, resilience practices, tooling and outcomes.
• Proven success designing, implementing and simplifying enterprise risk standards, procedures and governance practices.
• Strong understanding of risk management within highly regulated or critical infrastructure environments.
• Ability to connect incidents, issues and control weaknesses to root causes and systemic management actions.

Responsibilities

• Lead Optus' enterprise approach to non-financial risk management, establishing standards, methodologies and best practices across the business.
• Own and continuously improve core risk processes including RCSA, issues management, incident management, risk acceptance and material change assessments.
• Lead the end-to-end delivery of the enterprise RCSA program, scheduling cycles, facilitating self-assessments, aggregating results and quality-assuring outputs across business units.
• Translate the enterprise Risk Management Approach (RMA) and Risk Appetite Statement (RAS) into practical, business-facing risk policies, standards and minimum requirements that can be consistently applied.
• Set clear standards for issue severity rating, ownership, closure criteria, evidence and escalation, and for incident classification, root cause analysis and lessons learned.
• Scope and conduct post-incident reviews (PIRs), leading independent root cause analysis and delivering actionable recommendations, and maintain the lessons-learnt repository for the organisation.
• Partner with specialist risk teams and business leaders to embed consistent risk practices across technology, cyber, network, resilience, privacy, fraud and security domains.
• Build practical NFR capability across the Three Lines of Defense through guidance, education and targeted uplift.
• Support Executive and Board reporting on non-financial risk themes, issues, incidents, remediation, resilience and control environment trends.
• Act as the enterprise architect for non-financial risk, designing the risk processes and practices that are built into Optus' GRC platform - critical to enabling scalable, well-managed risk across the organisation.

Skills

Leadership

Stakeholder management

Risk management

RCSA

Incident management

Governance

Regulatory compliance

Education

Bachelor's degree

Tools

GRC tooling

GRC platform

Job description

*We are open to candidates who are based in Sydney and Melbourne. Optus is an Australian telecommunications company, delivering more than 11 million services to our customers every day across mobile, broadband, and digital solutions.

At Optus, we're building a modern, integrated Security & Risk function that brings together enterprise risk, cyber security, physical security and resilience to better protect our customers, people and business. This is a unique opportunity to join at a pivotal time and shape a best-in-class risk function and set the benchmark for how non-financial risk is managed across one of Australia's largest critical infrastructure organisations.

We're looking for an experienced Senior Director, Non-Financial Risk Management to report into the EGM, Integrated Risk and Controls Management and own the enterprise disciplines, RCSA, issues, incidents, risk acceptance, material change risk, and risk and control remediation that translate Optus' Risk Management Approach into consistent, practical execution.

This is a high-impact role for an experienced NFR leader who can build the bridge between the enterprise risk framework and day-to-day management of risk across the business. You will set the standards, simplify the processes and hold the line on quality, so that risk is visible, controls are effective and remediation is disciplined. You will work across operational, technology, cyber, network, resilience, third-party, compliance, privacy, fraud and security domains to create consistency without adding bureaucracy, and you will drive standardised, contemporary risk practice disciplines and tooling that prioritises and address Optus' highest exposures.

What You’ll Do

• Lead Optus' enterprise approach to non-financial risk management, establishing standards, methodologies and best practices across the business.
• Own and continuously improve core risk processes including RCSA, issues management, incident management, risk acceptance and material change assessments
• Lead the end-to-end delivery of the enterprise RCSA program, scheduling cycles, facilitating self-assessments, aggregating results and quality-assuring outputs across business units.
• Translate the enterprise Risk Management Approach (RMA) and Risk Appetite Statement (RAS) into practical, business-facing risk policies, standards and minimum requirements that can be consistently applied.
• Set clear standards for issue severity rating, ownership, closure criteria, evidence and escalation, and for incident classification, root cause analysis and lessons learned.
• Scope and conduct post-incident reviews (PIRs), leading independent root cause analysis and delivering actionable recommendations, and maintain the lessons-learnt repository for the organisation.
• Partner with specialist risk teams and business leaders to embed consistent risk practices across technology, cyber, network, resilience, privacy, fraud and security domains.
• Build practical NFR capability across the Three Lines of Defense through guidance, education and targeted uplift.
• Support Executive and Board reporting on non-financial risk themes, issues, incidents, remediation, resilience and control environment trends.
• Act as the enterprise architect for non-financial risk, designing the risk processes and practices that are built into Optus' GRC (Governance, Risk & Compliance) platform - critical to enabling scalable, well-managed risk across the organisation.

What makes you perfect for the role?

• Minimum 15 years’ experience in non-financial risk, operational risk, risk frameworks or controls within a large, complex organisation.
• Deep expertise with RCSA, risk acceptance, incidents, issues management and control assessment, resilience practices, tooling and outcomes.
• Proven success designing, implementing and simplifying enterprise risk standards, procedures and governance practices.
• Strong understanding of risk management within highly regulated or critical infrastructure environments.
• Ability to connect incidents, issues and control weaknesses to root causes and systemic management actions.
• Experience scoping and leading independent post-incident reviews, with the rigour and objectivity to deliver credible root cause analysis and recommendations.
• Exceptional stakeholder engagement skills with the ability to influence executives and translate complex risk concepts into practical business outcomes.
• Experience in telecommunications, banking, financial services, energy, utilities or another highly regulated or critical infrastructure.

What’s in it for you?

• Competitive remuneration and employee discounts. Make life easier (and more affordable) with $80 monthly credit and 25% off Optus products and unique shopping discounts with our retail partners.
• Flexible working arrangements with opportunities to work three days in the office, two days remote or home.
• Competitive leave policies, including additional 'Connected' days to focus on culture, family, health, community, or whatever’s important to you.
• We support growing families with inclusive, carer-neutral paid Parental Leave of up to 16 weeks.
• Build meaningful connections through employee-led networks and diversity initiatives including Culture Connect, Elevate Women, Disability Network and Express Yourself (LGBTQIA+).
• Put your wellbeing first with free access to counselling and support services, 24/7 - in-person, by phone, SMS, or video.

At Optus, we are strengthened by others and that means valuing diversity and saying ‘yes’ to embracing individual differences. We are committed to ensuring that our application process provides an equal employment opportunity to all job seekers, including individuals from diverse gender, cultural and linguistic backgrounds, individuals with a disability, individuals identifying as being part of the LGBTQIA+ community, individuals who may have served in the armed forces or who identify as Aboriginal and/or Torres Strait Islander. We also want to do our best to make our recruitment process inclusive. If you require any adjustments or accessibility support to participate fairly and equitably in the recruitment process, please email [e-mail] or call 1800 309 170. We're here to help. When you contact us, please advise your preferred method of contact and we will be in touch within 48 hours.

For more information on Diversity, Inclusion & Belonging at Optus, please visit https://www.optus.com.au/about/inclusion-diversity.