NFR & OP RES-Assistant Manager

Protiviti Middle East Member Firm; Riyadh; On-site; SAR 90,000 - 120,000; Full time

Job summary

Protiviti Middle East Member Firm in Riyadh seeks an Assistant Manager – Non-Financial Risk & Operational Resilience to lead advisory engagements. You will identify critical services, map processes and test disruption scenarios, advising on remediation and governance across BCM, incident management and risk controls.

You'll guide workstreams, supervise junior staff and collaborate with client teams to embed robust risk management and regulatory-aligned practices within the business.

Qualifications

• Bachelor's degree in risk management, business administration, finance, economics; a relevant postgraduate degree is advantageous.
• Working knowledge of the SAMA Business Continuity Management Framework and relevant Saudi regulatory expectations.
• Knowledge of Basel Committee Principles for Operational Resilience and sound operational-risk management; familiarity with leading international operational-resilience practices.
• Familiarity with ISO 22301; certifications such as CBCI/MBCI, ISO 22301 Lead Implementer/Auditor, CRISC, CISA or equivalent are advantageous, not mandatory.
• Strong command of Microsoft PowerPoint, Excel and Word; familiarity with business process mapping tools and techniques and GRC platforms is useful.
• Fluent professional English is required; Arabic capability is advantageous.

Responsibilities

• Identify and validate important/critical business services and operations, including service-owner engagement and approval packs.
• Facilitate impact-tolerance workshops and support development of quantitative and qualitative measures reflecting multiple harm dimensions.
• Map end-to-end processes and dependencies to deliver critical services and identify vulnerabilities.
• Design and execute scenario testing, tabletop exercises and simulations for clients.
• Review and enhance business impact analyses, continuity strategies, BCPs and incident response processes.
• Lead defined client workstreams across non-financial risk topics and governance design.
• Develop operational-risk metrics, dashboards and management information for decision making.
• Maintain knowledge of day-to-day NFR activities to credibly advise client units.

Skills

Non-financial risk

Operational resilience

Regulatory awareness

Project leadership

Stakeholder communication

Education

Bachelor's degree in risk management, business administration, finance, economics

Postgraduate degree advantageous

Tools

Microsoft PowerPoint

Microsoft Excel

Microsoft Word

Job description

Job Description - Assistant Manager, NFR & OP RES

Role information

Job title

Assistant Manager – Non-Financial Risk & Operational Resilience

Location

Primary sectors

Banking and financial services; other regulated and critical-service sectors as required

The Assistant Manager will work directly with clients to deliver Non-Financial Risk (NFR) advisory engagements, with operational resilience as a core domain, leading defined workstreams from planning through final output. The role requires the practical, hands-on capability to help client organizations identify critical services, establish disruption tolerances, map end-to-end business processes and dependencies, test severe but plausible scenarios and remediate vulnerabilities. The individual will apply this expertise across the wider non-financial risk landscape our clients need support with, including operational risk, business continuity management (BCM), third-party/outsourcing risk, incident and crisis management, control frameworks and regulatory compliance ,bringing a business-process and governance lens rather than a technical or systems focus to every engagement.

Key responsibilities

Operational resilience (primary focus):

• Support clients in identifying and validating their important/critical business services and critical operations, including service-owner engagement and approval packs.
• Facilitate client impact-tolerance workshops and support development of quantitative and qualitative measures reflecting customer, financial, operational, legal/regulatory and reputational harm.
• Map clients' end-to-end business processes and the people, process, information, facilities and internal, intra-group and third-party dependencies required to deliver critical services, using business process mapping techniques; identify vulnerabilities and concentration risks for the client.
• Design and execute scenario testing, tabletop exercises and simulations for clients using severe but plausible disruption scenarios; document lessons, actions and evidence of remediation.
• Review and enhance clients' business impact analyses, continuity strategies, BCPs, crisis-management arrangements and incident response/escalation processes, aligning with the client's wider non-financial risk and control frameworks.

Generic NFR / operational risk:

• Lead defined client workstreams across non-financial risk strategy, frameworks, policies and procedures, including target operating model (TOM) transformation and governance design.
• Conduct current-state, maturity and regulatory gap assessments for clients; analyze evidence, identify root causes and translate findings into prioritized, practical recommendations.
• Design and support clients' implementation of broader operational-risk frameworks, including risk and control identification, RCSA input and loss-event analysis.
• Develop operational-risk metrics, KRIs, dashboards, committee reporting, action trackers and management information that support clients' informed decisions and escalation.
• Maintain working knowledge of day-to-day NFR/operational-risk activities and business support, so as to credibly advise client business units on routine non-financial risk matters.

Third-party risk management (TPRM):

• Support clients with outsourcing and third-party risk assessments, due-diligence reviews and ongoing monitoring, coordinating with technology, cyber and third-party specialists on resilience inputs where relevant, while maintaining an end-to-end business-process and service perspective as the primary focus of the role.

Engagement delivery and practice contribution:

• Plan interviews and workshops, prepare agendas and materials, capture decisions, manage evidence requests and maintain a clear audit trail.
• Supervise analysts and consultants, review working papers and deliverables, provide timely coaching and ensure work complies with internal quality standards.
• Support proposals, credentials, market research, thought leadership, effort estimation and development of reusable methods and tools.

Experience

• Typically 4-7 years of relevant experience in non-financial risk (NFR), operational resilience, operational risk, business continuity management (BCM), crisis management, third-party risk or related risk advisory work. Given the limited standalone operational resilience talent pool in the GCC, candidates with strong operational risk and/or BCM experience who are open to developing into operational resilience are welcome; role-specific training will be provided.
• Experience in a consulting/advisory environment or in a regulated financial institution is strongly preferred.
• Demonstrable experience delivering at least two of the following for clients or internal stakeholders in a project-delivery capacity: service identification and mapping; business process mapping; impact tolerances; scenario testing; BCM/BIA; crisis and incident management; third-party resilience; operational-risk frameworks and controls.
• Experience leading small workstreams, coordinating client stakeholders and reviewing junior team output on client engagements.
• Banking or financial-services experience and exposure to Saudi/GCC regulatory expectations are preferred.

Qualifications and knowledge

• Bachelor's degree in risk management, business administration, finance, economics or a related discipline; a relevant postgraduate degree is advantageous.
• Working knowledge of the SAMA Business Continuity Management Framework and relevant Saudi regulatory expectations.
• Knowledge of Basel Committee Principles for Operational Resilience and sound operational-risk management; familiarity with leading international operational-resilience practices.
• Familiarity with ISO 22301; certifications such as CBCI/MBCI, ISO 22301 Lead Implementer/Auditor, CRISC, CISA or equivalent are advantageous, not mandatory.
• Strong command of Microsoft PowerPoint, Excel and Word; familiarity with business process mapping tools and techniques and GRC platforms is useful.
• Fluent professional English is required; Arabic capability is advantageous.

Risk domain capabilities required to deliver client engagements. Ability to flex across the broader NFR domains with depth expected in operational resilience.