Manager, Non-Financial Risk

Senior Non-Financial Risk (NFR) Leader – Second Line of Defense

About the Role

As the senior Non-Financial Risk leader within the second line of defense, you will provide strategic leadership and independent oversight for the development, localization, implementation, and continuous enhancement of NFR frameworks across the country. You ensure alignment with Group Risk standards, internationally recognized risk management frameworks (including COSO and ISO 31000), and the Central Bank of Kenya (CBK) Prudential Risk Management Guidelines.

You drive the embedding of a strong risk culture and control environment across the organization, enabling the business to operate within approved risk appetite through proactive identification, assessment, monitoring, and mitigation of non-financial risks. You also provide independent challenge and oversight across a broad range of risk areas, including operational, technology, conduct, third-party, financial crime, and compliance risks.

Key Responsibilities

• Strategic Leadership & Framework Implementation: Lead the development and localization of NFR frameworks; ensure alignment with Group standards, COSO ERM, ISO 31000, and CBK Prudential Guidelines.
• Risk Culture & Control Environment: Drive embedding of a strong risk culture; ensure the business operates within approved risk appetite.
• Independent Challenge & Oversight: Provide robust challenge across operational, technology, conduct, third-party, financial crime, and compliance risks.
• End-to-End NFR Lifecycle: Own risk identification, assessment, monitoring, reporting, and response.
• Governance & Reporting: Prepare and present risk reports to senior forums (EXCO, RCC, BRC); escalate material risks and influence decision-making.
• Assurance & Remediation: Conduct risk assurance reviews, control effectiveness assessments; drive remediation actions and close control gaps.
• Incident Management: Oversee end-to-end incident management (identification → escalation → RCA → remediation); identify systemic issues and drive sustainable fixes.
• Stakeholder Engagement: Influence business heads and senior management as a trusted advisor while maintaining second-line independence.

Qualifications

• Type of Qualification: First Degree
• Field of Study: Risk Management, Finance, Accounting, Economics, or related disciplines
• Professional / Technical Certifications (Strongly Preferred): FRM / PRM / CFA (Risk specialization); CPA / ACCA; CISA / CRISC / CIA

Experience Required

8–10 years of experience with:

• Minimum 8–10 years in risk management (2nd or 3rd line)
• Demonstrated ownership of the end-to-end NFR lifecycle
• Hands-on experience implementing and embedding enterprise risk frameworks (COSO ERM / ISO 31000 or equivalent)
• Proven experience covering multiple risk types
• Preparing and presenting risk reports to senior governance forums
• Escalating material risks and influencing decision-making
• Providing independent challenge to senior stakeholders while maintaining credibility
• Conducting risk assurance reviews and control effectiveness assessments
• Driving remediation actions and closing control gaps
• Experience with combined assurance or coordination across assurance providers (Risk, Compliance, Internal Audit) preferred
• Practical end-to-end incident management experience
• Evidence of identifying systemic issues and driving sustainable fixes
• Strong track record of influencing business heads / senior management as a trusted advisor
• Ability to balance challenge vs. partnership in complex stakeholder environments

Competencies

Behavioural Competencies

• Challenging Ideas
• Convincing People
• Developing Expertise
• Developing Strategies
• Embracing Change
• Making Decisions
• Providing Insights
• Upholding Standards

Technical Competencies

• Advanced knowledge of: Risk identification, assessment, measurement, and reporting; risk response strategies and control effectiveness evaluation.
• Strong understanding of: Non-Financial Risk (NFR) frameworks, policies, and risk appetite implementation; Combined Assurance and governance integration; data, risk reporting, and analytics for decision-making.
• Practical experience in: Incident management and root cause analysis; risk scenario analysis and stress testing; third party risk management and due diligence oversight.
• Familiarity with: Risk tools/systems.