Job Description

The Lead Operational Risk Specialist will serve as a primary driver for operational stability and transformation, building and operationalizing the risk management framework across EWS Operations. Rather than maintaining static risk logs and reactive controls, this individual will establish a zero-to-one management system that integrates data-driven risk insights across technology evolution, vendor dependencies, platform rationalization, and crisis resilience.

This role will partner across Operations, Technology, Product, DevOps, and Compliance to challenge legacy risk assumptions, surface hidden exposure, and implement automated controls. In addition to driving cross-functional alignment, this leader will establish high standards for key risk indicators, operational continuity, and system availability without slowing delivery cadence.

What you will do:

• Shape the Operational Risk Strategy: Design, deploy, and operationalize EWS Operations’ risk framework, risk appetite statements, and RCSA processes aligned directly to executive business strategy.
• Establish Executive Metrics & Reporting: Build automated key risk indicator (KRI) dashboards and executive reporting cadences to provide senior tech leadership with clear line-of-sight into top operational exposure areas.
• Lead Crisis Readiness & Business Continuity: Conduct Business Impact Analyses to define RTO (recovery time objectives) /RPO (recovery point objectives) standards and execute crisis simulations to test resilience during major outages or security disruptions.
• Drive Predictive Risk Analytics: Evaluate the operational impact of security events as a key stakeholder, orchestrating cross-functional responses to mitigate downtime.
• Post-Incident Remediation (RCA): Lead post-event operational analyses following major platform incidents or security events, ensuring root causes translate directly into tracked control improvements.
• Modernization & Migration Oversight: Embed operational risk evaluations directly into legacy system rationalization projects.
• Mitigate Third-Party Dependencies: Build processes to audit, monitor, and mitigate operational exposure stemming from critical vendor integrations, API dependencies, and external platform tools.
• Control Design & Optimization: Partner with engineering, DevOps, and platform teams to design automated internal controls that prevent systemic failure without introducing workflow friction.
• Ensure Regulatory & Audit Alignment: Serve as the primary partner for internal audit and external regulatory alignment across operational workflows.

What experience you need:

• 6+ years of progressive experience in Operational Risk Management, Technology Risk, IT Audit, or Operational Resilience within complex, cloud-enabled technology enterprise environments.
• B2+ English proficiency.
• Proven experience building or scaling risk frameworks, control environments, or BCDR programs within tech or operations units.
• Deep functional understanding of cloud environments, system dependency mapping and technology change management processes.
• Hands-on experience translating operational incidents into business impact assessments and root-cause remediation plans.
• Demonstrated ability to influence cross-functional engineering and operational teams without direct line authority.

What could set you apart:

• Action-Oriented Resilience: You don’t stop at logging risks; you relentlessly drive root-cause remediation and advocate for proactive safeguards.
• Proven Transformer: You have a demonstrated track record of evolving an organization away from reactive incident response toward automated, data-driven risk management.
• Cross-Functional Vision: You deeply understand the intersection of technology evolution, operational continuity, regulatory compliance, and business performance.
• Industry Certifications: You hold recognized credentials such as CRISC, CISA, CBCP, or ISO 31000/27001 Lead Implementer.
• Disruptive Thought Leadership: You actively challenge legacy controls when they slow down delivery and push for sharper, automated measures of risk and resilience.
• Global Team Exposure: Experience operating across distributed international teams.

Primary Location:

CRI-Heredia

Function:

Function - Security Governance and Compliance

Schedule:

Full time