CRO – Enterprise Risk — Cloud Platform

The mandate

An institutionally backed cloud platform is consolidating product lines across a region whose regulatory, customer and operating complexity has outgrown its risk governance. Local teams use different taxonomies, escalation thresholds and evidence standards. As products and data move, the board cannot see whether exposure is genuinely reducing or merely being transferred between markets.

The CRO – Enterprise Risk will oversee risk across approximately €1,850 million in annual recurring revenue and lead about 900 employees and material partners. The perimeter includes enterprise risk, compliance, operational resilience, technology and product risk, third parties, controls, investigations, reporting and risk talent. The executive reports to the Group Chief Executive and the relevant board committee.

The opening work is a regional risk map tied to product consolidation. Products, customers, data, contracts, services and suppliers should show which obligations move, combine or cease. The CRO will identify orphaned controls, conflicting ownership and exposures hidden by aggregated ratings. Each material risk needs a first-line owner and a forum authorised to decide it.

Common taxonomy should improve comparability without erasing local law or customer consequence. Definitions, severity and appetite must be consistent enough for the board to allocate attention. Genuine regional differences should be documented as such, with evidence and accountable exceptions rather than parallel frameworks.

Escalation needs decisive routes. Teams should know which signals require immediate action, who may accept residual exposure and how disagreement reaches the board. The CRO will test whether bad news moves quickly through the organisation and whether incentives delay disclosure. High-severity issues cannot wait for a routine reporting cycle.

Product consolidation changes operational and technology risk. Data migration, access, service continuity, compatibility and product retirement need independent challenge at decision gates. The risk team should not become the operator of remediation, but it must verify that first-line evidence demonstrates the intended control and customer outcome.

Sustainable remediation requires root cause and endurance. Closing an action in a tracker does not prove risk reduction. Design testing, operating tests, customer or service evidence and observation over time should support closure. Repeated issues need a review of accountability, incentives or architecture rather than another local patch.

Third-party concentration may increase when product lines share cloud, data or service providers. The CRO will aggregate dependency across regions, examine contractual rights and exercise contingency. A supplier attestation cannot replace recovery evidence when one failure could affect multiple products simultaneously.

Risk reporting will become decision oriented. Appetite, trend, control performance, customer consequence, capital and actions should reconcile. The board should see uncertainty and disagreement, not only a coloured summary. Named data owners must improve quality where current reporting depends on manual interpretation.

The risk organisation itself needs appropriate independence, technical capability and regional reach. The CRO will assess leaders, simplify duplicative assurance and build succession for material disciplines. First, second and third-line work should complement rather than repeat one another.

Why this seat is open

The need arose outside the approved hiring plan when consolidation exposed divided risk ownership. Interim arrangements protect urgent decisions, but the board intends to appoint within four to six weeks through confidential, evidence-led diligence.

What you will own

• Map regional risk to products, obligations and consolidation decisions.
• Provide independent challenge across approximately €1,850 million of annual recurring revenue.
• Establish comparable appetite, taxonomy and escalation standards.
• Govern migration, retirement and shared-platform risk gates.
• Lead approximately 900 employees and material partners.
• Verify remediation through sustained operating evidence.
• Aggregate third-party concentration and test contingency.
• Strengthen risk leadership, assurance efficiency and succession.

The first 12 months

The first 90 days should reconstruct material exposure, meet the 30 stakeholders closest to regional complexity and assess risk leaders. Stabilise severe gaps, review the consolidation plan and agree appetite, evidence and escalation gates with the board committee.

Months four to nine should implement the common framework, conduct thematic reviews of priority migrations and simplify assurance. Close material issues only after tested evidence, strengthen supplier contingency and fill capability gaps.

By year end, risk transparency, decisive escalation and sustainable remediation should be demonstrable. Performance must remain within 10% of approval, while three forecasts align exposure, cash, customers, products and people. Any severe issue requires board-owned action or verified closure within 30 days.

What the board will measure

• Regional exposure comparable without losing local regulatory facts.
• Product consolidation passing risk and customer evidence gates.
• Escalations reaching authorised decision makers without delay.
• Remediation sustained through independent operating tests.
• Retention above 90% for critical talent and ready cover for 70% of direct reports.
• Third-party concentration supported by exercised contingency.

The person

You are a CRO, Risk Director or senior controls executive with 18–22 years in technology or an adjacent regulated enterprise. You have held independent challenge authority and closed material issues with evidence accepted by board or supervisory review.

Your accountable P&L, book, budget or portfolio has been at least €1,050 million, and you have led 625 or more people. Examples must show results sustained across two reporting periods and distinguish your judgement from institutional process.

You understand cloud, product consolidation and regional governance. You can challenge optimistic executive cases, preserve practical followership and make risk information useful to capital and customer decisions.

Compensation and terms

Base compensation is €340,000–460,000 plus annual incentive and LTI. This permanent Berlin role is onsite and supports international relocation. Notice periods up to six months can be accommodated.

Confidentiality

The organisation, consolidation plan, exposures and control evidence remain confidential. Identifying information will follow mutual relevance under a formal undertaking; published facts are intentionally composite.