Risk Manager - Paylink

Job Summary:PayLink is seeking a Risk Manager to lead its Enterprise Risk Management (ERM) function as an independent control function. You will develop and maintain the risk management framework, assess risks across the business, and provide clear insights that support informed decisions, business resilience, and compliance with applicable Saudi Central Bank (SAMA) requirements.The role works closely with senior management, relevant committees, and departmental risk owners while maintaining independent oversight and clear accountability.

Key Responsibilities

Governance, Strategy and Risk Management FrameworkDevelop and update the Enterprise Risk Management (ERM) framework, policies, methodologies, tools and templates, and submit them for approval under the delegation of authorityPrepare an annual risk management strategy and work plan aligned with the Company's strategy, license category and scale of operationsDefine roles, responsibilities, escalation lines, risk owners and control owners in coordination with relevant departments, without imposing unapproved operational authoritySupport the Risk Committee and relevant committees by preparing materials and reports and tracking decisions within each committee's mandateReview the framework periodically following product, business model or regulatory changes or material events Risk Identification, Assessment and Risk RegisterLead enterprise assessments of inherent and residual risk in collaboration with departmental risk ownersEstablish and maintain the enterprise risk register, documenting causes, impacts, controls, assessments, treatment owners and target datesCoordinate Risk and Control Self-Assessments (RCSA) and challenge the reasonableness of assessments against available evidenceAssess enterprise risks arising from new products and services, material changes, projects, expansion and partnerships before recommendations are submittedConduct scenario analyses and stress testing in line with priorities, capabilities and available data, in coordination with Finance, Operations and Technology Risk Appetite, Indicators and ReportingDevelop and review the risk appetite statement and tolerance limits in coordination with Finance, Compliance, Operations, Cybersecurity and other stakeholders, and submit them to the authorized approving bodyDevelop a proportionate set of Key Risk Indicators (KRIs), defining data sources, data owners, measurement frequency and alert thresholdsMonitor risk appetite breaches, analyze their causes, recommend mitigation and escalate under approved authoritiesProduce concise periodic reports for senior management and relevant committees on material risks, trends, breaches, remediation plans and decisions required Control Assessment and Independent ChallengeAssess control design adequacy and effectiveness from a risk management perspective, using supporting evidence, test results, reports, interviews and appropriate samplesRequest information and evidence necessary for risk assessments within approved access rights, need-to-know principles, confidentiality and data protection requirementsDocument professional disagreements with risk or control owners and escalate material matters through approved channelsDo not operate controls, make specialist operational decisions or substitute for Internal Audit's independent assurance role Financial, Operational, Technology and Financial Crime RisksMonitor risks relating to liquidity, settlements, partner banks, fraud, operations, third parties, concentration, reputation and strategy in coordination with their respective ownersAssess cybersecurity and technology risks within the enterprise framework in coordination with Cybersecurity and Technology, without assuming their specialist or operational responsibilitiesInclude money laundering, terrorist financing and proliferation financing risks in the enterprise risk register and independently challenge exposures, controls and residual risk in coordination with Compliance and the AML officerAccess appropriate transaction, alert and suspicion-related indicators for risk assessment, subject to confidentiality restrictions on reports and protected case files; this role does not include investigating individual cases or making regulatory reporting decisionsEnsure enterprise assessments align with specialist risk assessments without creating conflicting assessments or transferring ownership of specialist programs to Risk Management Business Continuity and Crisis ManagementOversee the Business Continuity Management (BCM) framework and program through the Business Continuity Officer and relevant functions, monitoring plans, testing and remediation readinessReview Business Impact Analysis (BIA) results, verify business owners' validation of impacts and dependencies, and confirm that Technology and Operations have assessed recovery target feasibilityMonitor business continuity, disaster recovery and crisis management plans and tests, while operational response and recovery remain with designated teamsReport material readiness gaps to senior management and relevant committees, coordinating with Compliance on regulatory notifications Third Parties, Changes and ProjectsAssess risks relating to suppliers, outsourcing, third-party dependencies, concentration and single points of failure in collaboration with relationship ownersReview risks associated with projects, material changes and new services and provide recommendations before approvalTrack risk mitigation plans, action owners and deadlines without executing other departments' remedial actions Regulatory Requirements, Coordination and AwarenessMonitor regulatory requirements applicable to the risk management function and compile supporting evidence with Compliance and relevant stakeholdersParticipate in supervisory visits and respond on enterprise risk management topics using validated information, referring specialist technical topics to their ownersTrack regulatory and Internal Audit findings relevant to Risk Management and verify remediation by responsible ownersDeliver practical risk awareness and training to risk owners and promote risk culture throughout the CompanyMaintain orderly records of evidence, assessments, reports, decisions and relevant correspondenceRequirementsBachelor's degree in Risk Management, Finance, Accounting, Business Administration, or a related discipline; a postgraduate qualification is preferredPreferably at least seven years of relevant experience in risk management, governance, or financial services, including leadership experience, subject to applicable fit-and-proper requirementsPractical experience within financial institutions or payment service providers supervised by the Saudi Central Bank (SAMA)Working knowledge of Enterprise Risk Management (ERM), Risk and Control Self-Assessments (RCSA), risk appetite, Key Risk Indicators (KRIs), Business Continuity Management (BCM), internal controls, and regulatory reportingRelevant professional credentials, such as FRM, CRMP, RIMS-CRMP, or an ISO 31000-related qualification, are preferred and complement practical experienceStrong analytical judgment and independent assessment skills, with the ability to connect risk exposures to business objectives and regulatory impactEffective communication, cross-functional coordination, and professional conflict management skillsAbility to prepare clear executive reports and provide practical, actionable recommendationsStrong planning and prioritization skills, including tracking remediation activities within available resourcesAbility to evaluate evidence and data while maintaining the confidentiality of sensitive informationLeadership and coaching skills, with the ability to strengthen risk culture and influence stakeholders without direct line authority