Operational Risk Officer

Responsible for leading the design, implementation, and ongoing enhancement of the Bank's Operational Risk Management Framework and provides independent second-line oversight of operational risk across the organization. The role oversees key operational risk programs, including risk and control assessments, operational loss and event management, model risk management, physical security, information security and technology risk, and operational resilience. As a trusted advisor to executive management, the Operational Risk Officer delivers decision-useful risk insights, supports strategic decision-making, and drives continuous improvement in risk management practices across the Bank.

• Owns and maintains the Bank's Operational Risk Management Framework, including related policies, standards, procedures, and methodologies. Develops, maintains, and recommends operational risk appetite metrics, limits, thresholds, and escalation triggers; monitor performance against approved appetite and escalate material breaches or adverse trends.
• Leads enterprise-wide Risk and Control Self-Assessments (RCSAs) and independent challenge processes. Evaluates inherent and residual risks, control effectiveness, and management action plans. Provides independent risk review and challenge of new products, services, material business changes, strategic initiatives, and significant technology implementations to identify and address operational risks prior to implementation.
• Provides training and guidance to business units regarding risk identification and control expectations.
• Provides independent second-line oversight of the Bank's Model Risk Management Program, including model inventory, risk tiering, lifecycle governance, validation, performance monitoring, change controls, exceptions, and issue remediation. Reviews model risk assessments, validation results, key risk indicators, material model changes, and remediation activities; escalate significant issues to executive management and the Board, as appropriate.
• Provides independent second-line oversight of the Bank's physical security program, including facility access controls, security systems, incident management, emergency preparedness, and protection of employees, customers, information, and physical assets. Reviews physical security risk assessments, incident trends, key risk indicators, testing results, and remediation plans; provides effective challenge and escalate material concerns, as appropriate. Assesses physical security risks associated with branches, offices, critical facilities, cash-handling locations, and changes to the Bank's operating footprint.
• Provides independent second-line oversight of Information Security, Cybersecurity, and IT Risk programs, including review of key risk indicators, technology incidents, and control effectiveness.
• Administers the Bank's operational loss event and near-miss reporting process. Conducts or oversees root cause analyses and trend evaluations. Monitors corrective actions to ensure timely and sustainable remediation. Identifies repeat issues requiring executive attention and aggregates operational risk exposures across business units, products, technology platforms, and risk programs to identify concentrations, interconnected risks, and emerging enterprise-level exposures.
• Supports the oversight of business continuity planning and operational resilience initiatives. Monitors testing results, recovery capabilities, and lessons learned from exercises or disruptions. Evaluates resilience risks associated with critical business services and third-party dependencies.
• Supports regulatory examinations and supervisory engagements related to operational risk, including preparation and review of risk assessments, management responses, remediation plans, and supporting materials.
• Leads cross-functional working groups focused on risk reduction and process improvement.
• Partners with HR to ensure staffing models are in-line with FTE allocation; interviews and selects employees; evaluates performance; provides corrective action and/or developmental plans.

• The ability to communicate effectively and clearly, both in verbal and written communications, as well as, present information to a variety of groups.
• Critical thinking skills and experience.
• Must work well independently, be self-motivated and results-oriented.
• Strong inter-personal skills are required to build relationships, collaborate, and communicate.
• Strong organizational skills.
• Strong business acumen, including strong analytical skills and ability to think critically.
• The ability to manage multiple tasks.
• Ability to respond to common inquiries or complaints from employees, customers, regulatory agencies, or members of the business community.
• Ability to influence senior leaders while maintaining independence and objectivity.
• Advanced proficiency in Microsoft Excel, PowerPoint, and reporting tools.
• Expertise in RCSAs, operational loss reporting, and root cause analysis.
• Working knowledge of IT governance, cyber risk management, business continuity, and regulatory expectations for technology risk.
• Strong knowledge of model risk management principles, model lifecycle governance, independent validation, performance monitoring, model limitations, and issue management.
• Working knowledge of physical security risk management, including access controls, security systems, incident response, facility risk assessments, emergency preparedness, and related governance expectations.
• Experience overseeing regulatory, audit, and management action plans, including issue validation, remediation governance, root cause analysis, and escalation of overdue or high-risk issues.
• Deep understanding of operational risk management principles and the Three Lines model.
• Understanding of operational risks associated with Banking-as-a-Service (BaaS) programs, fintech partnerships, embedded banking relationships, and third-party service integrations.

Sutton Bank is an Equal Employment Opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, age, national origin, sexual orientation, gender identity, pregnancy, disability or protected veteran status.