Sr. Enterprise Risk Operations Specialist

We need to output HTML fragment with sections: Use

for headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections that have real specific content. We need to parse the posting. First, there is a mission description: "Our Mission Reflection is a research lab..." That's about the company, not role overview. Could be "About the role"? Actually "Role Overview" section is present. So we can put that under

About the role

maybe. The instruction: Use

for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So we can include About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits. Pay and Schedule only if present. The posting does not mention salary specifics, just "Top-tier compensation: Salary and equity structured to recognize and retain our talent globally." That's vague but mentions compensation. However we should not create Pay section unless posting actually states them. It says "Top-tier compensation: Salary and equity structured..." That's still vague but it's a statement about compensation. The instruction: "never create Pay/Schedule/Benefits sections unless the posting actually states them." It does state compensation, albeit not specific numbers. So we could include a Benefits section (they list benefits). Pay section maybe not needed because no specific salary numbers. But we could include Pay if we consider "Top-tier compensation: Salary and equity..." as pay info. However they said "Prefer a few substantive sections over many thin ones." Might combine compensation into Benefits? But Benefits already listed. Could create a Benefits section and include compensation details there. Pay section maybe omitted. Schedule: not mentioned. Thus sections: About the role (role overview), Responsibilities (What You'll Do), Requirements (Experience & Background), Qualifications (maybe Skills & Capabilities? Actually Qualifications could be experience/background; Skills could be Skills & Capabilities). We have "What We're Looking For" split into Experience & Background, Skills & Capabilities, Mindset & Approach. Could map Experience & Background to Requirements, Skills & Capabilities to Skills, Mindset & Approach maybe to Qualifications? Or we could combine. But we need to follow headings list: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits. We'll assign: - About the role: Role Overview paragraph. - Responsibilities: What You'll Do (list of duties). - Requirements: Experience & Background (the bullet points). - Qualifications: maybe Skills & Capabilities? Actually Qualifications often refer to education/degrees etc. Not present. Could skip Qualifications if no specific content. But we need to include only when posting has real specific content. There's no explicit qualifications like degree, certifications. So we may omit Qualifications. - Skills: Skills & Capabilities (list). - Benefits: What We Offer (list of benefits). Also include compensation statement there. We must not repeat job title as heading. No Job ID. We must preserve all substantive information, not invent or summarize away detail. Must not omit details. So we need to include all details from each section. We need to format lists using

• . For prose use

  . We need to remove boilerplate: cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, application instructions. There's none except maybe Export Control Notice at end. That's legal/boilerplate? It's an export control notice; might be considered legal boilerplate. Should we remove? It's not cookie/navigation/legal/EEO/equal-opportunity/scam-warning. It's a legal notice about export control. Might be considered legal boilerplate; but it's substantive? It's a condition of employment. Might be relevant. The instruction: "Remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate". Export Control Notice is legal; likely should be removed. We'll remove it. Also remove duplicated lines: none. Now craft HTML. We'll start with

  About the role

  then

  containing the Role Overview paragraph(s). The Role Overview includes multiple sentences. We'll keep as one

  maybe multiple paragraphs? Could split but keep as one. Then

  Responsibilities

  then
  with each duty as
  • . The "What You'll Do" includes several bullet-like paragraphs each starting with a bold heading? Actually the text: "Drive the end-to-end lifecycle for risk assessments and certifications supporting the deals pipeline and go-to-market efforts, ensuring risk reviews are completed with the speed and rigor the business requires.Partner closely with sales, legal, and product teams to scope and deliver risk assessments tailored to customer requirements, industry verticals, and deal-specific obligations.Develop and maintain a library of reusable risk assessment artifacts, certifications, and evidence packages that accelerate commercial cycles without compromising quality.Serve as a risk subject-matter expert in customer-facing conversations, due diligence requests, and RFP responses involving risk, compliance, and AI safety topics." Then separate sections for Third-Party & Vendor Risk Management, Controls Assurance & Obligation Validation, Risk Issue Management & Remediation. Each has multiple sentences. We'll treat each sentence as separate
  • ? Better to keep each bullet as a logical duty. Could break by the bold headings: Commercial Risk & Go-to-Market Support, Third-Party & Vendor Risk Management, Controls Assurance & Obligation Validation, Risk Issue Management & Remediation. Under each there are multiple sentences. We could make each bold heading as a
  • containing the sentences. Or we could split each sentence into separate
  • . The instruction: "Use
    • for any list of duties/requirements/benefits". So we need to list duties. Likely each duty is a bullet. We'll parse each bold heading as a duty and include its description inside the
    • . Eg:
    • Commercial Risk & Go-to-Market Support: Drive the end-to-end lifecycle ...
    But we cannot use ? Not prohibited. We can include plain text. We'll keep the heading as part of the
    • text. Similarly for others. Now Requirements: Experience & Background bullet points. We'll make each bullet as
    • . Skills: Skills & Capabilities bullet points. Benefits: What We Offer bullet points. We must preserve all substantive information: include all details. Let's extract text. **About the role** (Role Overview): "Our Mission Reflection is a research lab making intelligence open and accessible for everyone to use, customize, and build on. We build open models that let anyone control their intelligence and help shape the future of AI. Our mission: make intelligence open and accessible to all. Role Overview The Sr. Enterprise Risk Operations Specialist position is a senior role within Enterprise Risk & Trust, reporting to the Head of Enterprise Risk & Trust. This is the hands-on expert who translates the organization’s risk governance frameworks and policies into operational reality — personally operating the machinery that validates adherence, surfaces issues, and drives resolution. The result is a continuously evidenced, audit-ready risk posture that can be confidently represented to customers, regulators, and leadership. Spanning commercial risk support, third-party risk management, controls assurance, and risk issue management, this role serves as an operational center of gravity for the Enterprise Risk & Trust function — coordinating across product, engineering, legal, and compliance teams to ensure risk obligations are not just understood, but actively evidenced and remediated where gaps exist. This is a high-visibility, high-impact individual-contributor role that operates across all business functions. Success requires the ability to translate complex risk concepts into verifiable risk management, influence without direct authority, and build trusted relationships internally and externally." We need to avoid repeating job title as heading; we already have heading About the role. The paragraph includes "Role Overview" and repeats Sr. Enterprise Risk Operations Specialist. That's okay. Now Responsibilities: We have sections: Commercial Risk & Go-to-Market Support - Drive the end-to-end lifecycle for risk assessments and certifications supporting the deals pipeline and go-to-market efforts, ensuring risk reviews are completed with the speed and rigor the business requires. - Partner closely with sales, legal, and product teams to scope and deliver risk assessments tailored to customer requirements, industry verticals, and deal-specific obligations. - Develop and maintain a library of reusable risk assessment artifacts, certifications, and evidence packages that accelerate commercial cycles without compromising quality. - Serve as a risk subject-matter expert in customer-facing conversations, due diligence requests, and RFP responses involving risk, compliance, and AI safety topics. Third-Party & Vendor Risk Management - Conduct upfront due-diligence assessments, ongoing risk monitoring, and on-demand risk reviews of third parties and vendors supporting organizational operations. - Design and operate a scalable third-party risk management program that reflects the organization’s risk appetite, vendor criticality tiers, and evolving regulatory expectations. - Define and maintain clear criteria for vendor risk tiering, onboarding requirements, and ongoing monitoring cadences — ensuring continuous visibility into the risk profile of the extended enterprise. - Coordinate with procurement, legal, and technology teams to ensure vendor risk findings are reflected in contracting, remediation timelines, and relationship management decisions. Controls Assurance & Obligation Validation - Validate and evidence the design and operational efficacy of policies, standards, controls, and guardrails related to risk management — translating governance intent into demonstrable operational outcomes. - Design and execute controls testing programs that provide reliable, audit-quality evidence of control effectiveness across the organization’s obligation landscape. - Develop and maintain structured assurance documentation that enables confident representation of risk posture to regulators, auditors, and enterprise customers. - Identify and escalate control design or operational gaps, working cross-functionally to drive timely and durable remediation. Risk Issue Management & Remediation - Operate the organization’s risk issue management lifecycle, including maintenance of the risk issue inventory, escalation protocols, remediation prioritization frameworks, and exception management. - Define and apply clear standards for issue documentation, severity classification, ownership assignment, and remediation timelines — ensuring accountability and visibility at all levels. - Drive prioritization of remediation efforts in alignment with the organization’s risk appetite, ensuring that the most consequential exposures receive appropriate urgency and resources. - Manage the exception management process, including evaluation, approval, compensating control requirements, and time-bound tracking of all active exceptions. - Provide regular reporting to leadership on open issues, remediation velocity, exception inventory, and systemic risk trends, enabling informed decisions on risk tolerance and resource allocation. Now Requirements (Experience & Background): - 7+ years of progressive experience in risk operations, compliance, internal audit, information security, or a closely related discipline, with a demonstrated track record as a hands-on practitioner and builder of operational risk programs. - Demonstrated track record of building and operating scalable risk operational programs: controls assurance, third-party risk management, issue management, or incident response. - Hands-on experience with commercial risk support functions, including the delivery of risk assessments, certifications, or security questionnaires in a go-to-market or enterprise sales context. - Prior experience in technology risk operations — with working knowledge of AI system risk evaluation, safety testing methodologies, and the operational lifecycle of AI models. - Experience operating in regulated environments and interacting directly with auditors, regulators, or enterprise customers on risk, compliance, or security topics. Skills & Capabilities: - Exceptional operational discipline — proven ability to design, document, and run repeatable, audit-quality risk management processes at scale. - Strong analytical and investigative skills, with the ability to triage complex risk issues, synthesize large volumes of evidence, and distinguish signal from noise. - Demonstrated ability to manage and report on multi-workstream operational programs, balancing competing priorities, tight timelines, and cross-functional dependencies. - Excellent written and verbal communication skills, including the ability to document risk findings clearly and represent the organization’s risk posture credibly in customer-facing and regulatory settings. - Proficiency in risk management tools and GRC platforms; familiarity with evidence management, controls testing workflows, and incident tracking systems. Mindset & Approach (maybe Qualifications? but we may skip Qualifications). However we could treat Mindset & Approach as Qualifications? The instruction list includes Qualifications. Could we put Mindset &