Enterprise Risk Management Officer

Summary:

Responsible for leading the the Bank's enterprise risk strategy, framework, and governance programs, providing independent second-line oversight of enterprise and strategic risk. Oversees risk appetite and key risk indicators, enterprise and targeted risk assessments, emerging risk, issue management, data governance, and policy governance, while advancing a strong risk culture through education, constructive challenge, and timely escalation. As a trusted advisor to executive management, the position delivers forward-looking, decision-useful risk insights that support the Bank's strategy, financial resilience, operations, customers, and reputation.

Qualifications:

Education: Bachelor's Degree in Finance, Business Administration, Accounting, Risk Management, Data Management, or related field.

Licenses/Certifications: CERP, CRMP, GRCP, FRM preferred.

Experience: Fifteen or more years of senior leadership experience in banking, enterprise risk management, operational risk, internal audit, compliance, data governance or related functions. Demonstrated experience managing or overseeing enterprise issue management, including risk rating, remediation governance, validation, closure, extensions, and escalation. Or equivalent combination of education and experience.

Essential Functions:

• Owns and maintains the Enterprise Issue Management Program, including issue identification, risk rating, root cause analysis, action planning, validation, closure, extension, acceptance, and escalation standards.
• Promotes consistent application of the Three Lines model, risk ownership, escalation requirements, and risk management practices across business units and legal entities. Coordinates enterprise risk reporting and provide effective challenge and decision support to executive management, Management Risk Committee, and the Board.
• Monitors risk appetite and KRI performance, investigates breaches or adverse trends, challenges management responses, and escalates material concerns through established governance channels. Coordinates risk appetite and KRI reporting to support transparent decision-making by executive management, Management Risk Committee, and the Board. Oversees the identification, aggregation, monitoring, reporting, and escalation of material enterprise concentrations and correlated risk exposures, including consideration of concentrations within the Bank's risk appetite, limits, and enterprise risk profile.
• Designs and executes targeted risk assessments in response to significant changes, new products or services, strategic initiatives, incidents, concentrations, regulatory developments, or emerging risks. Evaluates inherent risk, control design and effectiveness, residual risk, risk acceptance, and management action plans using consistent methodologies. Coordinates enterprise scenario analysis and stress-oriented risk assessments to evaluate plausible adverse conditions, concentrations, interconnected risks, and potential impacts on the Bank's strategy, financial resilience, operations, and overall risk profile.
• Partners with executive management and business leaders to identify, assess, monitor, and report risks that could affect achievement of the Bank's strategic objectives or long-term financial and operational sustainability. Evaluates strategic initiatives, new markets, mergers and acquisitions, material partnerships, and significant changes in products, services, delivery channels, or operating models for alignment with the Bank's risk appetite and risk-bearing capacity.
• Provides second-line leadership and oversight for the Bank's Data Governance Program, including governance structures, data ownership, stewardship, standards, data quality, lineage, classification, retention, and issue escalation. Partners with business, technology, information security, privacy, compliance, and records management stakeholders to establish clear accountability for critical data and data controls.
• Partners with Human Resources, Compliance, Internal Audit, business leaders, and other control functions to embed risk management expectations into leadership practices, performance processes, onboarding, and ongoing education.
• Coordinates materials, agendas, decisions, and follow-up actions for Management and Board Risk Committees. Ensures risk reporting integrates risk appetite, KRIs, enterprise assessments, issues, data governance, policy governance, and emerging risk information. Maintains appropriate documentation and evidence to support governance, audit, and regulatory examination activities.
• Partners with HR to ensure staffing models are in-line with FTE allocation; interviews and selects employees; evaluates performance; provides corrective action and/or developmental plans.

Knowledge/Skills/Abilities:

• The ability to communicate effectively and clearly, both in verbal and written communications, as well as, present information to a variety of groups.
• Critical thinking skills and experience.
• Strong inter-personal skills are required to build relationships, collaborate, and communicate.
• Strong business acumen, including strong analytical skills and ability to think critically.
• Ability to respond to common inquiries or complaints from employees, customers, regulatory agencies, or members of the business community.
• Ability to influence senior leaders while maintaining independence and objectivity.
• Advanced proficiency in Microsoft Excel, PowerPoint, and reporting tools.
• Strong knowledge of model risk management principles, model lifecycle governance, independent validation, performance monitoring, model limitations, and issue management.
• Experience overseeing regulatory, audit, and management action plans, including issue validation, remediation governance, root cause analysis, and escalation of overdue or high-risk issues.
• Deep understanding of enterprise risk management principles and the Three Lines model.
• Understanding of operational risks associated with Banking-as-a-Service (BaaS) programs, fintech partnerships, embedded banking relationships, and third-party service integrations.
• Working knowledge of policy lifecycle governance, document standards, exception management, and regulatory change alignment.
• Strong understanding of strategic risk, business model risk, strategic planning, scenario analysis, competitive and market dynamics, and risk-adjusted decision-making.
• Strong knowledge of emerging risk management, horizon scanning, forward-looking risk indicators, scenario development, and cross-risk analysis.
• Experience leading enterprise and targeted risk assessments and synthesizing risk information across business units and risk disciplines.
• Experience developing and overseeing risk appetite statements, risk limits, key risk indicators, thresholds, and governance reporting.
• Experience establishing or overseeing data governance and policy and procedure governance programs.
• Experience evaluating strategic plans, material business initiatives, market or competitive developments, and business model changes from an enterprise risk perspective.
• Experience developing or administering emerging risk identification, assessment, monitoring, and reporting processes.

Sutton Bank is an Equal Employment Opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, age, national origin, sexual orientation, gender identity, pregnancy, disability or protected veteran status.