Operations & Outsourcing Risk

We are seeking an experienced Risk Management professional to lead and strengthen the organisation's Operational Risk and Outsourcing Risk Management framework.

The role will be responsible for identifying, assessing, monitoring, and mitigating operational and third-party risks across payment products, merchant acquiring, cross-border payments, and outsourced business operations. The incumbent will work closely with business, operations, compliance, technology, audit, and leadership teams to ensure adherence to regulatory requirements, network guidelines, and internal risk policies.

Operational Risk Management:

Develop, implement, and enhance the Operational Risk Management (ORM) framework, including Risk and Control Self-Assessments (RCSAs), across the organisation.

Identify, assess, monitor, and mitigate operational risks arising from payment operations, merchant onboarding, transaction processing, and customer servicing.

Drive corrective action plans arising from RCSA findings and control gaps.

Monitor Key Risk Indicators (KRIs), operational losses, incidents, and control effectiveness.

Lead root cause analysis and remediation for operational risk events.

Own SOP and policy lifecycle management — including drafting, versioning, and periodic review — for all operational risk policies and procedures.

Outsourcing Risk Management:

Manage end-to-end outsourcing risk governance for third-party vendors involved in KYC verification, PAN validation, customer onboarding, payment processing, and other critical functions.

Maintain and operate a vendor categorisation framework (IT/Non-IT, critical/non-critical outsourcing) and ensure risk assessments are calibrated to vendor tier and exposure.

Ensure compliance with RBI Outsourcing Guidelines, PA Master Directions 2025, and all applicable regulatory requirements.

Conduct vendor due diligence, risk assessments, performance reviews, and periodic audits.

Monitor SLA adherence, control effectiveness, and vendor risk exposure across the vendor portfolio.

Coordinate with the Information Security function on vendor security assessments, infosec control reviews, and technology risk evaluations for outsourced arrangements.