Job Summary
The Head of Enterprise Risk & Risk Strategy leads the Bank's enterprise-wide, non-financial risk management agenda and is accountable for the design, implementation, and continuous enhancement of the Enterprise Risk Management (ERM) Framework and Risk Management Framework across all risk types.
The role consolidates and challenges the Bank's aggregate risk profile and a principal source of operational, technology, fraud, third-party, and conduct risk — sets and monitors risk appetite for non-financial risk and instils a strong risk culture across the virtual bank. The role is the primary risk interface to the Risk Management Committee and Risk Oversight Committee and a strategic partner to Product, Technology, and Business leadership.
Key Responsibilities
- Drive the development, implementation, and periodic review of the Enterprise Risk Management Framework and the Risk Management Framework (non-financial risk), aligned with BOT regulatory expectations, COSO ERM, and the Three Lines of Defense model
- Own the Bank's Risk Appetite Statement and risk limit/tolerance structure for non-financial risk; cascade appetite into measurable metrics and thresholds
- Lead consolidated enterprise risk identification, assessment, aggregation, and reporting — producing an integrated view of the Bank's risk profile across strategic, operational, technology, third-party, fraud, data privacy, reputational, legal & compliance, people, and emerging risks
- Provide independent second-line oversight and challenge of risk management: consolidate the product's cross-risk-type assessment, review new product and material change approvals, and confirm risk mitigation plans are adequate and tracked to closure
- Oversee the enterprise risk governance structure, risk policies and standards hierarchy, risk taxonomy, materiality thresholds, escalation protocols, delegation of authority, and committee reporting calendar
- Oversee incident management governance at enterprise level, including significant incident escalation, thematic root cause analysis, loss data quality, and regulatory notification readiness
- Oversee enterprise business continuity and operational resilience: critical business service identification, impact tolerances, and testing adequacy for payment services
- Instill a strong, accountable risk culture across the Bank — risk culture measurement, training and awareness programmes
- Prepare and present risk profile reporting, appetite dashboards, and risk opinions to RMC, ROC, and the Board; also represent Risk Management with BOT and other regulators.
- Advise the Chief Risk Officer, CEO, and Executive Committee on risk implications of strategic decisions, and act as a credible business partner enabling growth within appetite
- Ensure regulatory compliance and examination/audit readiness across the non-financial risk perimeter, and drive timely remediation of findings
Qualifications
Experience
- Minimum 15 years of experience in enterprise risk, operational risk, or banking risk management, including significant time in a senior leadership role
- Proven experience designing and embedding ERM frameworks, risk appetite, and risk governance in a bank or regulated financial institution
- Experience leading multiple risk disciplines and sizeable teams across operational, technology, fraud, third-party, and data privacy risk
- Strong knowledge of risk frameworks — COSO ERM, Basel II/III operational risk, Three Lines of Defense, and operational resilience standards
- Demonstrated experience presenting to and engaging with board committees and regulators
- Experience in digital banking, virtual banking, payments, or fintech strongly preferred
Technical Skills
- Expertise in enterprise risk methodologies: risk taxonomy design, RCSA, KRI frameworks, scenario analysis, stress testing, risk aggregation and profiling, and capital/loss modelling for operational risk
- Strong understanding of digital banking and e-Payment operations, product economics, and end-to-end payment value chains
- Competence in risk governance and policy architecture, committee reporting, and regulatory engagement
- Familiarity with GRC platforms, risk data architecture, and analytics/BI tooling for enterprise risk reporting
- Strong analytical, judgement, and problem-solving capability; ability to form and defend independent risk opinions
- Excellent leadership, influencing, negotiation, and communication skills, with strong command of English and Thai
- Effective project management and change leadership skills
