Enterprise Risk Associate

Enterprise Risk AssociateReports to: Director – Strategy & Corporate Development

Location: Dubai, UAE (Group HQ), with travel to KSA and Qatar operationsLevel: Associate (3–5 years’ experience)Function: Strategy & Corporate DevelopmentRole PurposeAmana is implementing a group-wide Enterprise Risk Management (ERM) framework in partnership with a top global consulting firm.

The Enterprise Risk Associate will act as the internal counterpart to the external consulting team during design and rollout, taking ownership of the framework, documentation, knowledge transfer and formal handover. Following implementation, the role will maintain and continuously improve the framework as a permanent in-house capability.Beyond maintaining the framework, the Associate will expand the Key Risk Indicator (KRI) library and help move the group from periodic manual reporting toward near real-time risk monitoring using connected internal data.Success is not simply having a risk register in place. It is ensuring risk insights measurably inform decisions at bid stage, project stage and Board level.Key ResponsibilitiesFramework & GovernanceAct as the internal counterpart to the external consulting partner throughout implementation, ensuring documentation, knowledge transfer and formal handover.Maintain the group risk policy, taxonomy, scoring criteria and risk appetite statements, including the annual refresh cycle.Administer the risk register across corporate, business unit and major project levels.Risk Identification & AssessmentFacilitate risk workshops and one-to-one interviews with business unit leadership, project directors and functional heads across the UAE, KSA and Qatar.Challenge risk ratings rather than simply record them, particularly where likelihood or impact may be underestimated.Maintain KRIs, monitor tolerance breaches and escalate issues against defined triggers.Project & Commercial RiskEmbed risk reviews into the tender and bid approval process, covering contract terms, client creditworthiness, liquidated damages, design and scope, supply chain and price escalation.Support project teams in establishing and maintaining live risk registers for major awards.Track realised risk events and losses, feeding lessons learned into future tender assumptions.KRI Development, Data & Real-Time MonitoringExpand the KRI library beyond the baseline established during framework design, prioritising measurable indicators supported by existing group data.Connect risk data across ERP, project controls, procurement, finance, HR and HSE systems into a consolidated monitoring layer, reducing manual data collection wherever possible.Build and maintain risk dashboards, progressing from quarterly manual reporting toward continuous, near real-time visibility with automated threshold alerts.Apply AI and automation to reduce manual effort and identify emerging risks earlier, including extracting and classifying information from contracts, incident reports and correspondence; detecting anomalies in project and financial data; and drafting risk commentary from underlying figures.Prototype, test and improve solutions directly. This is a hands-on implementation role, not solely a requirements-writing role.Business Continuity & Crisis ManagementMaintain and periodically test business continuity and crisis management plans.ReportingProduce quarterly risk reports for the Executive Committee and Audit & Risk Committee, progressively reducing manual preparation effort.Maintain live risk dashboards for executive and business unit audiences using Power BI or an equivalent platform.Culture & TrainingDeliver risk awareness training and serve as an initial point of contact for business risk matters.Required Qualifications & ExperienceBachelor’s degree in Engineering, Finance, Business Administration or a related discipline. An engineering background is advantageous given the construction context.3–5 years of experience in enterprise risk management, including at least two years in a dedicated ERM role. General internal audit, QHSE or compliance experience alone is insufficient.Preferred background: Risk advisory at a Big Four firm (Deloitte, EY, KPMG or PwC), a specialist risk consultancy (Marsh, Aon, WTW, Gallagher or Protiviti), or an in-house risk function within a large GCC contractor, developer, industrial group or government-related entity.Demonstrable GCC experience in the UAE and/or KSA, with a working understanding of regional clients, contracting practices and payment environments.Hands-on experience building or operating risk registers, facilitating risk workshops and preparing board-level risk reports.Preferred CertificationsISO 31000 Practitioner / Lead Risk ManagerIRM (Institute of Risk Management) Certificate or DiplomaPMI-RMP (Project Risk Management Professional)CRMA (Certification in Risk Management Assurance)Skills & AttributesTechnical capability: Advanced Excel and Power Query, with demonstrable Power BI or equivalent BI platform skills, including building data models rather than simply consuming reports.Practical AI and automation: Ability to use large language models and automation to extract, classify and summarise risk data, and independently prototype working solutions. Candidates should be able to describe a solution they have actually built.Systems and data integration: Working knowledge of APIs, integrations, and structured versus unstructured data sources, sufficient to work effectively with IT and define requirements. SQL or Python literacy is an advantage but not mandatory.Risk technology: Familiarity with GRC or risk management software.Stakeholder management: Strong facilitation skills and the confidence to engage business unit MDs and project directors, challenge assumptions and secure buy-in from stakeholders who may be sceptical of head-office processes.Executive communication: Concise written English and the ability to translate complex risk information into a clear, one-page executive summary.Language: Arabic is an advantage given KSA operations.Working style: Comfortable operating as a standalone function with direct senior sponsorship rather than within a layered team.Success Measures — First 12 MonthsComplete the transition of the ERM framework from the external consulting partner, with no residual consultancy dependency.Establish a live group risk register populated across all business units and refreshed according to the agreed cycle.Embed risk review as a mandatory gate in the tender approval process.Materially expand the KRI library beyond the framework baseline, with the majority of indicators automated rather than manually compiled.Put a live risk dashboard into production, drawing from core internal systems, with defined threshold alerts operating.Deliver four quarterly risk reports to the Audit & Risk Committee.Secure approval of risk appetite statements and establish continuous monitoring of KRIs.