Chief Risk Officer — Urban Infrastructure Platform

The mandate

An urban-infrastructure platform manages projects and operating assets whose risk registers are reviewed across separate dimensions: land, utility interfaces, contractor capacity, public safety, community commitments and municipal approvals. Common dependencies affect several assets. The board is creating a CRO role to establish first-line ownership and provide assurance based on evidence rather than aggregated ratings.

The CRO will hold independent authority across approximately ₹26,400 crore in projects and operating assets and 725 employees and material partners. Scope covers enterprise, project, operational, contractor, safety-interface, financial, technology, climate and stakeholder risk. Project and asset leaders remain first-line owners. The CRO sets appetite, challenges acceptance, aggregates exposure and reports directly to the relevant board committee.

Recovery requires risk to change choices. A project forecast that depends on unresolved access, a vendor plan without recovery capacity or a service commitment without funded maintenance must reach an explicit accept, mitigate, transfer, rephase or stop decision. Risk review will not become a parallel project-control meeting or allow management to transfer accountability to the second line.

Urban assets have connected public consequences. One utility corridor, authority approval, systems integrator or specialist contractor may affect transport, public-space and municipal-service assets simultaneously. The CRO will map these dependencies, test simultaneous disruption and show where contingency or insurance is reused across projects.

Why this seat is open

This is planned new hiring under a board-approved risk model and has no predecessor. A four-to-six-month search allows the appointee to join before the next capital and talent cycle. Existing control leaders retain their accountabilities during selection.

What you will own

• Set risk appetite and acceptance across development, delivery and operations.
• Aggregate shared authority, contractor, corridor, technology and climate dependencies.
• Establish evidence gates for recovery plans, capital and service commitments.
• Test incident, continuity and contractor-recovery arrangements.
• Provide protected escalation and independent committee reporting.
• Develop project risk leaders with clear first- and second-line boundaries.

Risk appetite will be translated into thresholds teams can use. Severity, affected public, uncertainty, delay, remedy capacity and financial exposure will determine escalation. Exceptions must name the executive accepting residual risk, expire and return when facts change. Repeated waivers will force a structural decision.

Contractor resilience will include financial health, supervision, subcontractor control, claims behaviour, access to tooling and ability to recover. Liquidated damages do not restore service. Support to a distressed counterparty will carry milestones, information rights and exit routes.

Scenario exercises will involve authority and asset decision-makers. Flooding, utility strike, cyber loss, public-access incident and contractor collapse will test command, information, cash and customer communication. Findings must change contract, design, inventory, route or authority. Completion of a rehearsal is not itself control effectiveness.

Board assurance will separate inherent exposure, evidence, remediation trajectory and accepted residual risk. The CRO will state where data is insufficient and preserve technical dissent. Near misses will be examined for assumptions and incentives, not merely procedural compliance.

Assurance planning will follow consequence and change. New delivery baselines, contractor rescues, public openings and material design changes will receive deeper independent review than stable low-impact controls. Internal audit, safety, technical assurance and risk will coordinate scopes without merging mandates. The CRO will identify gaps and duplicated testing, then ensure primary evidence reaches the committee. Management self-certification will state the limits of knowledge and any reliance on third parties.

Community commitments and grievance patterns will be included in portfolio risk. Repeated access or nuisance concerns can become delivery and licence-to-operate exposure even without formal claim. Risk teams will test whether engagement actions are resourced and whether commitments can be honoured during contractor or ownership change.

The first 12 months

Within 90 days, the CRO will review the 20 highest-consequence risks, assess independence and contain pending commitments with weak evidence. The committee will receive an aggregate exposure map and interim acceptance rules.

By month eight, three recovery projects should use revised gates, five common dependencies should complete resilience tests and embedded risk leaders should have protected escalation. Severe-event exercises will include authorities and operating partners.

At year-end, high-risk exceptions should fall 60%, severe actions close 90% on time and risk-driven forecast surprises decrease 30%. Every material capital or service commitment must have a named first-line owner and independently reviewed evidence, with recovery objectives achieved in all scheduled exercises.

What the board will measure

• Independent challenge changing delivery and capital decisions.
• Shared urban dependencies visible across assets.
• Tested contractor and incident recovery.
• Explicit acceptance and funding of residual exposure.
• Strong risk leadership and succession.

The person

You are a CRO, infrastructure risk leader or project-assurance executive with 22–28 years of experience. You have governed at least ₹15,300 crore and 500 employees. Evidence must include a recovery plan you conditioned, a shared dependency you escalated and an exercise that changed public-service resilience.

This onsite Ahmedabad role requires extensive asset, authority, contractor and board travel. You can challenge technical evidence without assuming project delivery authority.

Compensation and terms

Fixed compensation is ₹2.2–3.0 crore plus performance variable. Measures include exposure reduction, gate quality, recovery evidence, remediation, independence and succession. Final calibration will follow the approved risk perimeter.

Confidentiality

The platform, projects, authorities, contractors and risk evidence remain confidential. Controlled details follow qualification and an undertaking. Ahmedabad and rounded figures are non-identifying.