Senior Manager, Operational & Technology Risk

OSL; Hong Kong; On-site; HKD 1,200,000 - 1,800,000; Full time

Job summary

OSL is seeking a Senior Manager, Operational & Technology Risk to design, implement, and oversee the firm’s global risk management framework across its cryptocurrency exchange and payments businesses.

In this second-line role, you will bridge governance with fast-paced digital asset technology, ensuring regulatory alignment and strong risk controls.

Qualifications

• 8–10 years in Operational Risk and Technology Risk within financial services.
• Proven track record in 2nd-line governance and regulatory audits.
• Familiarity with blockchain, custody architectures, or DeFi is preferred.

Responsibilities

• Lead enterprise and operational risk governance across global entities.
• Provide independent 2nd-line oversight of engineering, product, and IT security.
• Oversee technology change management, system availability, and security controls.
• Engage regulators during audits and licensing reviews; translate directives for teams.
• Drive risk and control self-assessment (RCSA) and incident lifecycle management.

Skills

Operational risk management

Technology risk oversight

Regulatory engagement

2nd-line governance

RCSA and incident management

Digital asset knowledge

Job description

As the Senior Manager, Operational & Technology Risk, you will design, implement, and oversee the Operational and Technology Risk Management Framework across the firm’s global cryptocurrency exchange and payments business. Acting as an independent second-line challenge function, you will bridge the structured governance and regulatory rigor of traditional investment banking with the fast-paced innovation of digital assets and tech infrastructure.

You will satisfy global regulatory standards- including Operational, Technology Risk Management guidelines and international regulatory frameworks- while supporting rapid business growth across multi-asset trading, custody, and payment services.

Key Responsibilities

1. Enterprise & Operational Risk Governance

• Lead the design, execution, and continuous enhancement of the Enterprise Risk Management (ERM) and Operational Risk Management Frameworks (ORMF) across global sub-entities.
• Standardize risk assessment methodologies to deliver a unified "Single View of Risk" for C-suite executive leadership, Board risk committees, and external regulators.
• Define risk appetite metrics, tolerance thresholds, and Key Risk Indicators (KRIs) across multi-asset class product lines.

2. Second-Line Technology & Cyber Risk Oversight

• Provide independent 2nd-line oversight and effective challenge to 1st-line Engineering, Product, and IT Security teams regarding system architecture, code deployment, and cloud infrastructure changes.
• Establish governance frameworks for technology change management, system availability, infrastructure vulnerabilities, and API integration points.
• Conduct targeted risk assessments on emerging technical initiatives, wallet infrastructure, smart contract deployments, and core exchange engine modifications.
• Oversee compliance with local and global technology risk regulations, specifically Technology Risk Management Guidelines, Cyber Hygiene standards, and international security frameworks

3. Operational Resilience Oversight

• Review and challenge Business Continuity Plans (BCP), Disaster Recovery (DR) testing, , and cyber resilience exercises
• Evaluate second-line Third-Party Risk Management (TPRM)

4. Regulatory Engagement

• Act as a key risk contact for regulators during regulatory audits, licensing reviews, and supervisory examinations.
• Translate complex regulatory directives and tech standards into clear, actionable requirements for product engineers and operations teams.

5. Core Risk Exercises & Incident Management

• Lead Risk and Control Self-Assessment (RCSA) exercises across all key business and technical functions
• Oversee the end-to-end incident management lifecycle for operational, IT, and cyber security events, driving Root Cause Analysis (RCA) to enforce remedial control improvements.

Professional Experience

• Experience: min 8-10 years in Operational Risk Management and Technology Risk Oversight, with significant experience in the financial industry
• Tech Risk Expertise: Proven track record in 2nd-line technology governance,
• Regulatory Proficiency: Direct experience managing audits or supervisory inquiries from major financial regulators, with deep knowledge in global risk expectations.
• Methodological Mastery: Mastery of core OpRisk and Tech Risk tools (RCSA, Incident Management, KRI monitoring, Scenario Analysis, RCA).
• Digital Asset Knowledge: Familiarity with blockchain mechanics, smart contract risks, custody architecture, or DeFi protocols is preferred

Vision & Mission

• OSL is the first SFC-licensed digital asset platform in Hong Kong and a PayFi innovator. Through stablecoin payments, cross-border settlement and global licensing, we are building the next-generation payments network. Stablecoins have become everyday money across emerging markets and are widely viewed as blockchain's "killer app," with industry focus shifting from token issuance to real-world consumer and enterprise payment adoption. The strongest growth lies in cross-border B2B payments, where providers embedding stablecoins into corporate settlement flows can capture significant volume and float. Long-term defensibility comes from regulatory licences, banking partners and cross-border corridors.
• OSL holds or has acquired licences in Hong Kong, Japan, Australia, Bermuda and Indonesia, and is expanding into Europe, Brazil, Southeast Asia and Africa through acquisitions and licence applications. With OSL Pay and StableX, we embed stablecoin settlement into bank accounts and card networks, support 150+ digital assets, and provide 24/7 fiat-stablecoin conversion. As a regulated pioneer with a startup mindset, we believe the future of payments will be driven by real adoption and scalable deployment, not technology narratives. We welcome builders who are passionate about crypto and payments to join us in shaping compliant, global payment infrastructure.