Senior Director, Enterprise Control Framework

About the role

Ethos is seeking a seasoned Director, Enterprise Control Framework to join our Compliance department as a senior leader. This person will own the design, documentation, and ongoing health of the company’s non-financial control framework - the single authoritative map of how Ethos’s regulatory and operational obligations translate into controls, who owns those controls, and how they are evidenced. This is not a Sarbanes-Oxley or internal-controls-over-financial-reporting role; financial reporting controls sit elsewhere. Instead, you will build and sustain the control architecture covering operational risk, including compliance, across the enterprise.

You will be the connective tissue between the obligations Ethos is held to and the day-to-day controls our first-line teams actually operate. You will also partner closely with our Compliance Risk Management (“CRM”) team, who independently monitor and test the controls you define. You design and document, CRM tests. Success in this role looks like a control framework that is complete, accurately mapped, understood by its owners, and critically, evergreen: never more than a change cycle behind the business or the regulatory landscape. You will start hands-on and are expected to build and lead a small team as the framework scales. Importantly, the candidate must be risk-minded, be a team player, confident in determining acceptable risk, and think creatively to always find solutions.

Duties and Responsibilities:

• Own the enterprise non-financial control framework end to end, including:
  • Risk and control mapping:map each obligation to the risks it creates and the first-line controls that mitigate them; surface gaps, redundancies, and orphaned controls
  • Control documentation: write clear, testable control descriptions including control owner, frequency, control type (preventive/detective, manual/automated), and required evidence
  • Taxonomy and standards: define and enforce a common control taxonomy, rating scale, and documentation standard used consistently across the company
  • Coverage assessment : identify where obligations are uncontrolled or under-controlled and drive remediation with first-line owners
• Keep the framework evergreen, including:
  • Establish the triggers and cadence that force the framework to update: regulatory change, product launches, new state or carrier approvals, system migrations, organizational change, and audit or exam findings
  • Run periodic control owner attestation and framework refresh cycles
  • Partner with the CRM team so that every material change lands as a concrete control change rather than a memo
  • Retire and consolidate controls that become obsolete
• Partner with the Compliance Risk Management team, including:
  • Hand off controls in a state that is ready to test: clearly scoped, with defined control owner, evidence, and testable pass/fail criteria
  • Maintain clear separation of duties between control design and independent control testing
  • Translate CRM testing results and control failures back into framework and control design improvements
  • Align the control framework to CRM’s inherent and residual risk assessment methodology so ratings stay consistent across programs
• Build and lead the function. Operate as a hands-on player-coach initially, then hire, develop, and manage a control framework analyst as scope grows
• Act as thought leader on control design and control framework governance across Ethos, influencing senior first-line and second-line stakeholders
• Support internal and third party audits, market conduct exams, regulatory requests, carrier requests, and data calls by producing the control mapping and documentation those reviews require
• Assist in drafting and updating compliance policies and procedures so that policy, procedure, and control documentation remain mutually consistent
• Provide general compliance support, as needed, across the team and company

 

Qualifications and Skills:

• 12+ years of relevant Compliance, controls, risk, or audit experience, including significant experience in insurance or another highly regulated financial services industry
• Demonstrated ownership of a control framework or risk and control inventory at enterprise scale - you have built or substantially rebuilt one, not only maintained an existing one
• Deep expertise in control design and documentation: writing controls that are specific, testable, and genuinely operable by the teams that own them
• Strong command of risk and control taxonomies, and control rating frameworks
• Experience partnering with an independent testing or monitoring function, and comfort with the separation of duties that requires
• Strong governance background, including experience presenting to risk and compliance committees and to executive leadership
• Strong understanding of regulatory change management and how regulatory change translates into control change
• Hands-on experience documenting and maintaining controls within GRC tooling administered by a partner team
• Exceptional written and verbal communication skills - clear, precise documentation is the core product of this role
• Persuasive communicator and thought leader, able to hold senior stakeholders to a documentation and evidence standard without becoming a blocker
• Experience hiring, developing, and managing a small team, or clear readiness to do so
• Possess sound and practical business judgment, and confidence in determining acceptable risk
• Ability to multi-task and work independently or with cross-functional teams, while adapting quickly to ambiguous and rapidly changing environments
• Exceptional attention to detail, with a high tolerance for structure and rigor
• Ability to work in a fast-paced environment and manage multiple deadlines

 

#LI-Hybrid

#LI-KP2