Head Non-Financial Risk Control Europe

About the role

The Head of Non-Financial Risk Control (NFRC) Europe leads oversight of non-financial risks across all European entities and ensures alignment with Group frameworks and regulatory expectations, including the Digital Operational Resilience Act (DORA). The role also acts as Head NFRC Luxembourg. It covers operational processes, internal controls, technology, cyber security, data, third parties and resilience, and coordinates with local first-line functions such as COO units, IT, Business Continuity, Compliance, Legal, Tax, Data Protection and CRO teams.

Key responsibilities

• Lead the European implementation of global frameworks (Internal Control, Operational Risk, Third Party Risk, Technology Risk and Resilience) and act as a trusted adviser to Local Risk Owners and senior stakeholders.
• Ensure compliance with Group policies and European regulatory expectations, and provide timely escalation of exposures outside risk appetite.
• Coordinate with Group Internal Audit, lead the annual Risk and Control Self-Assessment (RCSA), manage the European Control Plan and oversee quarterly internal controls assessments.
• Monitor operational incidents and near misses, drive early risk identification through scenario analysis and thematic reviews, and oversee Business Continuity, TPRM, Technology and Cyber oversight, KRI/KPI reporting and incident management.
• Manage the NFRC workforce across Europe, promote a strong risk culture, ensure succession planning and adherence to the Group Code of Ethics.

Required profile

• Bachelor's or Master's degree in Finance, Risk Management, Business or a related field.
• 10+ years of experience in risk management with significant exposure to non-financial risk, and proven leadership in a senior risk role.
• Experience with regulators and senior stakeholders, and a background in operational risk, technology risk, cyber security or non-financial risk in a regulated financial institution.
• Knowledge of European regulatory environments (DORA, EBA guidelines) and experience implementing global frameworks across jurisdictions.
• Preferred: relevant qualifications in Compliance and/or Risk Management (e.g. IRM, FRM, CRISC).

Required skills

• RCSA methodologies, control testing, incident management and third-party risk oversight.
• Familiarity with risk management platforms such as ServiceNow GRC, BaerGRC or equivalent.
• Strong leadership, analytical and communication skills, and ability to challenge and provide independent oversight.