CRO – Enterprise Risk — Engineering Centre

The mandate

Consolidation of several engineering sites into Budapest has exposed concentrations that their separate risk registers did not show. Product programmes share validation laboratories, simulation capacity, specialist approvers, software toolchains and component suppliers. Each programme's recovery plan assumes priority access to the same resources. The board created an enterprise CRO role outside the annual organisation plan.

The CRO – Enterprise Risk will hold independent authority across an engineering centre of approximately 2,975 employees and partners and a portfolio near HUF 390 billion. Scope includes operational resilience, product and engineering risk, technology, third parties, facilities, people concentration, change and risk governance. Engineering and product leaders remain first-line owners; safety, legal and regulatory specialists retain professional responsibilities. The CRO provides the aggregate view, challenge and escalation.

The role must distinguish redundancy from resilience. Keeping duplicate tools or labs can protect a critical product, but unmanaged duplication can also create inconsistent evidence and support. The executive will help leaders choose prevention, alternative capability, recovery, transfer or explicit risk acceptance based on consequence and feasibility.

Engineering information presents another exposure. Designs, test data and supplier access move through shared environments that consolidation may broaden. The CRO must ensure efficiency decisions preserve need-to-know boundaries, export obligations and clear evidence of who may approve and alter critical artefacts.

Risk aggregation should extend beyond obvious shared assets. Several programmes may use different suppliers whose software contains the same library, or different laboratories whose calibration depends on one provider. The CRO will establish methods for tracing these second-order connections and test model assumptions with engineers. Where the evidence is incomplete, uncertainty must remain visible in the decision rather than disappearing inside a low aggregate rating.

Board reporting will show both exposure and confidence in the underlying dependency evidence, preventing apparent precision from obscuring unknown concentration.

Why this seat is open

This is urgent, unplanned new hiring with no predecessor. The consolidation decision surfaced aggregate exposure that no existing programme or functional risk leader can own independently. Interim committee oversight can pause high-risk moves but cannot build the permanent risk system. The board seeks an executive within eight weeks before location and supplier commitments resume.

What you will own

• Build an aggregate dependency map across programmes, laboratories, people, tools, data, facilities and suppliers.
• Set enterprise risk appetite and acceptance routes for shared engineering concentration.
• Challenge consolidation, outsourcing and architecture decisions before dependencies become irreversible.
• Define minimum evidence and recovery tests for critical engineering and validation capability.
• Govern product and design information access as teams and platforms combine.
• Run severe-but-plausible exercises covering concurrent loss of shared resources and decision-makers.
• Establish independent risk reporting with access to incidents, change and supplier evidence.
• Build second-line leadership across resilience, engineering, third party and technology risk.

The first 12 months

Within 45 days, the CRO will identify the 20 most consequential shared assumptions and place interim controls around exposures above likely appetite. By day 90, the board will receive a consolidated risk map, acceptance proposals and a schedule of joint tests. Programme registers will reconcile to this enterprise view.

By month eight, at least three cross-programme exercises should test laboratory, toolchain and supplier loss. Findings will trigger funded design decisions, and critical information access will follow approved consolidation patterns. New programmes will include aggregate capacity and recovery evidence before approval.

At year-end, all critical shared resources should have tested recovery or time-bound board acceptance, undocumented single-person dependencies should fall by 80% and severe actions should close on time above 90%. No material design or export-control breach should arise from consolidation, and risk reporting should expose changes within the quarter they occur.

What the board will measure

• Aggregate engineering exposure made visible before location and investment decisions.
• Recovery proved through realistic tests rather than programme documentation.
• Independent challenge changing consolidation, supplier or platform choices.
• Closure or explicit acceptance of every exposure above appetite.
• Second-line capability and succession across specialist risk disciplines.

The person

You are a CRO, engineering-risk, product-safety or operational-resilience executive who has governed interdependent technical operations. You understand laboratories, design evidence, toolchains and suppliers sufficiently to test recovery claims without becoming the accountable engineer. Experience in automotive, industrial technology, aerospace, medical devices or complex R&D centres is relevant.

You bring 18–22 years of experience and have held independent risk responsibility above HUF 220 billion across an organisation of 2,100 people or more. Evidence should include a shared dependency missed by programme views, an engineering consolidation you altered and an exercise that drove capital or design change.

The role is onsite in Budapest and reports into the relevant board risk forum.

Compensation and terms

The CRO package carries HUF 135–185 million in base compensation, together with annual incentive and long-term incentives. Performance will recognise exposure visibility, tested recovery, decision quality and second-line depth. Lack of reported incidents alone is not achievement. Final terms reflect the approved risk perimeter and current mix, with customary vesting and malus protections.

Confidentiality

The programmes, laboratories, suppliers and consolidation locations are restricted. Qualified candidates receive further evidence after mutual interest and an undertaking. The Budapest base and rounded population must not be used to identify the engineering group.