Director Of Operational Risk

BDO LLP; Greater London; On-site; GBP 120,000 - 190,000; Full time

Job summary

BDO LLP in London seeks an experienced Director of Operational Risk to lead the UK 2LOD operating model for regulated activities. The role covers design and oversight of the operational risk framework, escalation to authorities and ongoing policy updates, with independent ownership of risk and regulatory obligations.

You will manage RCSA, KRIs and incident reporting, work with 1LOD to challenge risk activities, and coordinate with global risk colleagues on regulatory matters.

Responsibilities

• Serve as the primary operational risk point of contact for UK regulators (FCA, NFA), managing information requests and supervisory engagements.
• Own the entity's compliance with DORA including ICT risk management, resilience testing, third‑party risk oversight and incident reporting obligations.
• Maintain knowledge of FCA Handbook, operational resilience requirements and related regimes (SYSC, SM&CR, MIFIDPRU/ICARA).
• Interpret evolving regulations, translate into embedded controls and framework updates.
• Prepare regulator-ready responses, attestations and submissions with accuracy and defensibility.
• Manage day-to-day operational risk activities (RCSA, KRIs, control monitoring, risk appetite).
• Oversee incident data capture, root-cause analysis and remediation tracking to closure.
• Provide 2LOD challenge to 1LOD activities across front office, operations and support functions.
• Support operational risk scenario analysis and ICARA inputs; contribute to risk assessments and capital considerations.
• Lead incident management lifecycle in line with FCA resilience and DORA expectations; escalate incidents per timelines.
• Escalate material incidents to Global Head of Enterprise Risk and SFL Head of Risk with clear actions.
• Provide 2LOD oversight of third‑party/outsourcing risk management and ensure alignment with DORA and FCA requirements.
• Coordinate with TPRM and procurement on testing, contracts and legacy arrangements.
• Act as an early‑warning function to flag local risks to Global Head of Enterprise Risk and SFL Head of Risk.

Job description

Director of Operational Risk - Second Line of Defence (2LOD) - London

Job description

We are recruiting for a Director of Operational Risk to join our client, a Financial Services firm, in their team for this permanent opportunity.

About the role:

The client is seeking an experienced Director of Operational Risk to lead the operational risk agenda for the UK legal entity from our London office. Reporting to the Global Head of Enterprise Risk and SFL Head of Risk, this is a senior Second Line of Defence (2LOD) role responsible for the design, oversight and continuous improvement of the operational risk framework across the Firm's regulated activities.

The candidate will act as a trusted, self-directed risk leader who can independently own and discharge the entity's local operational risk and regulatory obligations — including engagement with the Financial Conduct Authority (FCA), compliance with the Digital Operational Resilience Act (DORA), and coordination with the National Futures Association (NFA) and other applicable authorities. A defining expectation of the role is the ability to escal.

Key responsibilities include;

• Serve as the primary operational risk point of contact for UK and applicable overseas regulators, including the FCA and NFA, managing information requests, thematic reviews, and supervisory engagement independently and to a high professional standard.
• Own the entity's compliance with the EU/UK Digital Operational Resilience Act (DORA), including ICT risk management, digital operational resilience testing, ICT third-party risk oversight, and major ICT-related incident reporting obligations.
• Maintain current knowledge of the FCA Handbook (SYSC, SM CR), operational resilience requirements (important business services, impact tolerances and mapping) and the MIFIDPRU / ICARA regime as it relates to operational risk.
• Interpret new and evolving regulations, assess entity impact, and translate requirements into practical, embedded controls and framework updates without requiring day-to-day direction.
• Prepare regulator‑ready responses, attestations and submissions, ensuring language is accurate, proportionate and defensible.
• Independently manage the day‑to‑day operational risk activities of the UK entity, including Risk & Control Self‑Assessments (RCSA), control monitoring plans, key risk indicators (KRIs) and risk appetite monitoring.
• Oversee the operational risk event / loss data capture process, ensuring timely recording, root‑cause analysis, and remediation tracking to closure.
• Provide 2LOD challenge and oversight to First Line of Defence (1LOD) risk and control activities across front office, operations and support functions.
• Support operational risk scenario analysis and capital assessment inputs feeding the entity's ICARA, including frequency and severity calibration where required.
• Lead the operational risk aspects of the entity's incident management lifecycle — identification, triage, escalation, coordination, resolution and post‑incident review — in line with FCA operational resilience and DORA incident‑reporting expectations.
• Ensure incidents that breach impact tolerances or regulatory reporting thresholds are escalated immediately and reported to the relevant authority within required timeframes.
• Escalate to the Global Head of Enterprise Risk at the earliest sign of a material incident or emerging local concern, providing a clear, factual assessment and recommended actions.
• Provide 2LOD oversight and challenge of the third‑party / outsourcing risk management lifecycle.
• Ensure ICT third‑party arrangements are managed in line with DORA and FCA outsourcing and operational resilience requirements, with appropriate identification of critical or important suppliers and concentration risk.
• Coordinate with TPRM and procurement teams on control testing, contractual risk provisions and remediation of legacy third‑party arrangements.
• Act as an early‑warning function for the Global Head of Enterprise Risk, proactively flagging any local operational risk, control, incident or regulatory concern before it escalates, then informing the SFL Head of Risk.
• Build effective working relationships with 1LOD business heads, Compliance, Legal, Internal Audit (3LOD), and global risk colleagues across EMEA, APAC, North and Latin America.
• Represent operational risk at relevant governance forums and risk committees, presenting balanced, evidence‑based assessments.
• Substantial experience in operational risk management within a regulated financial services firm (brokerage, investment firm, banking or capital markets), at a Director level.
• Demonstrable, hands‑on experience of direct regulatory engagement with the FCA and familiarity with the NFA and other applicable EMEA regulators.
• Working knowledge of DORA and the ability to operationalize its ICT risk management, resilience testing and incident‑reporting requirements.

About you: This role reports directly to the Global Head of Enterprise Risk in the US and the SFL Head of Risk, forming part of the 2LOD. The role holder is expected to operate with a high degree of independence in managing local operational risk regulatory requirements, while maintaining an open and timely escalation channel to both the Global Head of Enterprise Risk and SFL Head of Risk on all matters of local concern.

Additional Information

Location: London

Duration: Permanent