Head of Non-IT Operational Risks / TPRM

Project overview

The Head of Non-IT Operational Risks & TPRM leads the management of non-IT operational risks and third-party risks. He/she maintains and evolves the risk management and internal control framework in accordance with Group policies and regulatory requirements on outsourcing. His/her scope notably covers HR, Finance, Compliance, Purchasing, suppliers, data governance, and outsourced services.

His/her responsibilities include identifying, assessing, and documenting Non-IT risks, conducting RCSA exercises, and monitoring controls and action plans. For TPRM, he/she defines the policy, procedures, and tools, maintains the third-party repository, and classifies them according to their criticality. He/she coordinates due diligence, particularly on financial, operational, compliance, security, data protection, ESG, and business continuity risks.

He/she contributes to managing contractual risks with Purchasing and Legal, especially regarding audit rights, service levels, subcontracting, and exit arrangements. He/she organizes continuous monitoring of service providers—periodic reviews, indicators, incidents, and remediation—and monitors concentration or dependency risks. The framework must comply with applicable rules, including EBA guidelines, the decree of November 3, 2014, and, for ICT providers, DORA.

The position includes defining control plans, analyzing their results, monitoring corrective measures, and audit recommendations. He/she produces internal and regulatory reports on Non-IT and third-party risks, informs management, and promptly reports significant situations. He/she responds to audits and inspections and ensures the availability of supporting documents, particularly for supplier files.

The function promotes a Risk and Compliance culture, communicates procedures and best practices, raises awareness among business units about their responsibilities towards third parties, and supports them in implementing appropriate controls. It serves as a reference point for Non-IT operational risks and TPRM.

The profile sought has expertise in operational risks, internal control, TPRM, RCSA methodologies, and control plans. He/she is familiar with outsourcing rules and third-party compliance issues (AML/CFT, sanctions, anti-corruption, GDPR), as well as financial and Purchasing processes; knowledge of HR, data governance, and GRC/TPRM tools is also expected or appreciated. Rigor, analytical skills, synthesis, pedagogical ability, autonomy, and the capacity for constructive challenge are essential.

The position involves close collaboration with operational teams, Risk and Compliance, Purchasing, Legal, IT Security, the DPO, business managers, service providers, management, auditors, and Group stakeholders. Its objectives are to secure Non-IT activities, manage third-party risks, ensure compliance and traceable governance, and embed a shared risk culture.

Project details

• Start: flexible
• Remote: hybrid
• Location: 93100 Montreuil, France, FR
• Rate: 81-81 EUR/h
• Languages: French