NFR & OP RES-Assistant Manager

. Job Description - Assistant Manager, NFR & OP RES Role information Job title Assistant Manager – Non-Financial Risk & Operational Resilience Location Riyadh, Saudi Arabia Primary sectors Banking and financial services; other regulated and critical-service sectors as required Role purpose The Assistant Manager will work directly with clients to deliver Non-Financial Risk (NFR) advisory engagements, with operational resilience as a core domain, leading defined workstreams from planning through final output. The role requires the practical, hands-on capability to help client organizations identify critical services, establish disruption tolerances, map end-to-end business processes and dependencies, test severe but plausible scenarios and remediate vulnerabilities. The individual will apply this expertise across the wider non-financial risk landscape our clients need support with, including operational risk, business continuity management (BCM), third-party/outsourcing risk, incident and crisis management, control frameworks and regulatory compliance ,bringing a business-process and governance lens rather than a technical or systems focus to every engagement. Key responsibilities Operational resilience (primary focus): - Support clients in identifying and validating their important/critical business services and critical operations, including service-owner engagement and approval packs. - Facilitate client impact-tolerance workshops and support development of quantitative and qualitative measures reflecting customer, financial, operational, legal/regulatory and reputational harm. - Map clients' end-to-end business processes and the people, process, information, facilities and internal, intra-group and third-party dependencies required to deliver critical services, using business process mapping techniques; identify vulnerabilities and concentration risks for the client. - Design and execute scenario testing, tabletop exercises and simulations for clients using severe but plausible disruption scenarios; document lessons, actions and evidence of remediation. - Review and enhance clients' business impact analyses, continuity strategies, BCPs, crisis-management arrangements and incident response/escalation processes, aligning with the client's wider non-financial risk and control frameworks. Generic NFR / operational risk: - Lead defined client workstreams across non-financial risk strategy, frameworks, policies and procedures, including target operating model (TOM) transformation and governance design. - Conduct current-state, maturity and regulatory gap assessments for clients; analyze evidence, identify root causes and translate findings into prioritized, practical recommendations. - Design and support clients' implementation of broader operational-risk frameworks, including risk and control identification, RCSA input and loss-event analysis. - Develop operational-risk metrics, KRIs, dashboards, committee reporting, action trackers and management information that support clients' informed decisions and escalation. - Maintain working knowledge of day-to-day NFR/operational-risk activities and business support, so as to credibly advise client business units on routine non-financial risk matters. Third-party risk management (TPRM): - Support clients with outsourcing and third-party risk assessments, due-diligence reviews and ongoing monitoring, coordinating with technology, cyber and third-party specialists on resilience inputs where relevant, while maintaining an end-to-end business-process and service perspective as the primary focus of the role. Engagement delivery and practice contribution: - Plan interviews and workshops, prepare agendas and materials, capture decisions, manage evidence requests and maintain a clear audit trail. - Supervise analysts and consultants, review working papers and deliverables, provide timely coaching and ensure work complies with internal quality standards. - Support proposals, credentials, market research, thought leadership, effort estimation and development of reusable methods and tools. Candidate profile - Assistant Manager Experience - Typically 4-7 years of relevant experience in non-financial risk (NFR), operational resilience, operational risk, business continuity management (BCM), crisis management, third-party risk or related risk advisory work. Given the limited standalone operational resilience talent pool in the GCC, candidates with strong operational risk and/or BCM experience who are open to developing into operational resilience are welcome; role-specific training will be provided. - Experience in a consulting/advisory environment or in a regulated financial institution is strongly preferred. - Demonstrable experience delivering at least two of the following for clients or internal stakeholders in a project-delivery capacity: service identification and mapping; business process mapping; impact tolerances; scenario testing; BCM/BIA; crisis and incident management; third-party resilience; operational-risk frameworks and controls. - Experience leading small workstreams, coordinating client stakeholders and reviewing junior team output on client engagements. - Banking or financial-services experience and exposure to Saudi/GCC regulatory expectations are preferred. Qualifications and knowledge - Bachelor's degree in risk management, business administration, finance, economics or a related discipline; a relevant postgraduate degree is advantageous. - Working knowledge of the SAMA Business Continuity Management Framework and relevant Saudi regulatory expectations. - Knowledge of Basel Committee Principles for Operational Resilience and sound operational-risk management; familiarity with leading international operational-resilience practices. - Familiarity with ISO 22301; certifications such as CBCI/MBCI, ISO 22301 Lead Implementer/Auditor, CRISC, CISA or equivalent are advantageous, not mandatory. - Strong command of Microsoft PowerPoint, Excel and Word; familiarity with business process mapping tools and techniques and GRC platforms is useful. - Fluent professional English is required; Arabic capability is advantageous. Core capabilities Risk domain capabilities required to deliver client engagements. Ability to flex across the broader NFR domains with depth expected in operational resilience.