ORM Lead

Position: Operational Risk Management (ORM) Lead

Job Level: C2

Experience: 12–15 Years

Work Locations: NCR | Chennai | Bengaluru | Pune

Work Schedule: Flexible to work across shifts, aligned with US client requirements.

1. Role Overview

We are looking for a highly experienced Operational Risk Management (ORM) Lead to establish, manage and independently oversee the Operational Risk Management function for a large-scale US BFSI engagement.

This is a senior leadership position requiring strong expertise in operational risk frameworks, risk governance, control design, control testing, root cause analysis, issue management and regulatory compliance.

The individual will be responsible for setting up and managing the ORM operating model independently from the existing delivery teams, ensuring effective risk oversight, strengthening the control environment and driving governance standards in collaboration with senior US client stakeholders.

The role will involve leading multiple teams across Quality Assurance (QA), Control Design and Control Execution, while ensuring robust risk management practices, audit readiness and adherence to client-specific regulatory and governance requirements.

2. Key Roles & Responsibilities

A. Operational Risk Framework & Governance

• Own and independently manage the Operational Risk Management function, operating separately from the existing delivery teams.
• Establish and implement the operational risk framework, risk taxonomy, control governance structure and risk management methodologies.
• Define the Risk and Control Matrix (RCM), risk registers, governance structures and RACI framework, clearly establishing ownership and accountability.
• Establish governance cadence, reporting mechanisms and performance monitoring frameworks in coordination with the US client team.
• Develop and maintain Key Risk Indicators (KRIs), Key Control Indicators (KCIs) and Key Performance Indicators (KPIs).

B. Risk Assessment, Control Testing & Issue Management

• Lead and oversee Risk and Control Assessments, Root Cause Analysis (RCA), control testing and issue management programmes.
• Evaluate control design effectiveness and operating effectiveness to ensure controls are appropriately designed and functioning as intended.
• Review, approve and validate RCA outcomes, ensuring identification of underlying control weaknesses and operational risk exposures.
• Approve corrective action plans and monitor remediation activities through to closure.
• Identify recurring control failures, emerging operational risks and areas requiring process or control improvements.
• Ensure effective documentation and maintenance of control evidence and remediation records.

C. Leadership & Team Management

• Provide strategic direction and oversight to teams across QA, Control Design and Control Execution.
• Lead and manage a workforce of 20+ professionals, ensuring effective team structure, role clarity and accountability.
• Define team objectives, performance metrics, operational KPIs and governance standards.
• Drive resource planning, team ramp-up, capability development and delivery readiness.
• Establish a structured 30/60/90-day ramp-up and readiness plan aligned with client expectations and operational requirements.

D. Client & Stakeholder Management

• Act as a senior point of contact for US client stakeholders on operational risk, controls and governance matters.
• Drive regular governance discussions, risk reviews, control performance updates and management reporting.
• Present risk dashboards, control failure reports, remediation updates and audit/compliance reports to relevant stakeholders.
• Partner with business, operations, risk, compliance and audit teams to strengthen the overall control environment.
• Ensure alignment between delivery operations and the client's risk governance expectations.

E. Audit, Regulatory Compliance & Reporting

• Support internal audits, external audits and regulatory examinations.
• Ensure audit readiness through appropriate control documentation, evidence management and record retention practices.
• Oversee reporting of control failures, operational risk exposures, remediation progress and compliance-related matters.
• Ensure adherence to applicable regulatory and control requirements, including SOX 302/404, SEC 17a-4, FINRA, ERISA, GLBA, CCPA and NAIC, as relevant to the engagement.
• Maintain appropriate governance documentation and ensure timely closure of audit observations.

F. Operating Model & Managed Services Transition

• Lead the transition from a Time-and-Materials (T&M) engagement model to a Managed Services operating model.
• Define the operating model, governance cadence, delivery volumes, performance metrics and accountability structure.
• Establish clear processes for risk oversight, control execution, reporting and escalation.
• Ensure operational readiness and effective transition of responsibilities in alignment with client requirements.

3. Mandatory Skills & Experience

• 12–15 years of overall professional experience.
• Minimum 5 years of experience in Operational Risk Management / Risk & Controls within US BFSI.
• Strong domain experience in US Insurance, Annuities, Retirement or Wealth Management.
• Proven experience leading Root Cause Analysis (RCA), Control Testing or Audit Programmes within the First or Second Line of Defence.
• Strong understanding of operational risk frameworks, risk taxonomy, risk registers and Risk Control Matrices (RCM).
• Hands-on experience in control design effectiveness and operating effectiveness testing.
• Experience in issue management, corrective action planning, remediation tracking and governance reporting.
• Strong understanding of SOX / ICFR key controls.
• Demonstrated experience in managing large teams of 20+ professionals across QA, Control Design and Control Execution.
• Experience interacting with senior US client stakeholders and managing governance discussions.
• Strong leadership, decision-making, analytical and communication skills.

Important: A general Quality Assurance (QA) background alone will not be sufficient. Candidates must have a strong and demonstrable Operational Risk / Risk & Controls background.

4. Good-to-Have Skills

• Experience with GRC / Integrated Risk Management (IRM) platforms such as:
• Archer
• MetricStream
• ServiceNow IRM
• Optro
• Experience in transitioning engagements from a Time-and-Materials model to a Managed Services model.
• Exposure to Power BI dashboards and risk reporting automation.
• Knowledge of US Life Insurance, Annuity and Retirement products.
• Experience developing 30/60/90-day ramp-up and operational readiness plans.
• Knowledge of relevant US regulatory frameworks:
• SOX 302 / 404
• SEC 17a-4
• FINRA
• ERISA
• GLBA
• CCPA
• NAIC

5. Academic Qualifications & Certifications

• Graduate / Postgraduate in Commerce, Finance, Business Administration, Risk Management or Accounting.
• MBA / CA / CPA qualification preferred.
• Certification in Internal Controls or SOX fundamentals preferred but not mandatory.

6. Training & Onboarding Areas

The selected candidate will be required to establish and align the following areas as part of the engagement's operational readiness:

• Risk framework and control taxonomy.
• Risk register and associated governance tools.
• Operating model, delivery volumes and performance KPIs.
• Governance cadence, reporting structure and escalation mechanisms.
• Client-specific evidence requirements and record-retention standards.

7. Role Scope & Boundaries

In Scope:

• Business and operational risk controls.
• Risk governance and control framework.
• Control design and control execution oversight.
• Control testing, RCA and issue remediation.
• Audit, compliance and risk reporting.

Out of Scope:

• Platform performance testing.
• System cutover validation.
• Transaction monitoring.

8. Ideal Candidate Profile

The ideal candidate should be a seasoned Operational Risk and Controls leader who has independently established or managed risk governance functions within a US BFSI environment.

The individual must bring a combination of strategic risk leadership, hands-on control oversight, regulatory and audit exposure, strong client-facing capabilities and experience managing large teams.

This position requires someone who can take ownership of the ORM function, establish a robust governance structure, drive control effectiveness and engage confidently with senior client stakeholders while leading the transition towards a mature Managed Services model.