Senior Risk & Control Manager

Key Responsibilities

• Business Acumen:
• Maintain an expert understanding of the Booking.com business, industry news and risk best practices and apply that knowledge in the context of your coverage areas (1 to 2 Business Units).
• Propose viable ideas and solutions and guide others in doing so.
• Make decisions independently, consult with peers and directors.
• Critical Thinking:
• Take a leading role in analyzing high risk/critical issues and defining solutions in a wide range of situations.
• Objective Setting, Prioritization & Task Management:
• Structure and prioritise your own work and the work of your team.
• Negotiate deliverables and timelines with stakeholders.
• Strongly contribute to the development of department objectives, priorities and ways of working.
• Attention to Detail:
• Oversee, review and, in some cases, execute the production of high quality, accurate output across a broad range of topics.
• Result Orientation:
• Lead others to achieve their team objectives and deliverables in line with personal and company values.
• Influence stakeholders at ELT-level in order to meet timelines and prioritize critical activities.
• Effective Communication & Presentation Skills:
• Communicate clearly and effectively with different types of stakeholders up to and including ELT-level and present information on a broad range of topics tailored to the intended audience.
• Frequently lead or present in larger meetings, periodically attend and contribute in Steering Committees or similar governance fora.
• Stakeholder Management & Influencing:
• Actively build and maintain an extensive network within the coverage area, including at senior levels ((E)(LT)) and provide in depth advice to stakeholders.
• Challenge and influence effectively and independently within your network where needed.
• Handle difficult conversations independently and know when and to whom to escalate information/decisions upwards.
• People Management:
• Manage small to medium sized teams direct reports. For direct reports actively develop their skills including performance management, career development, in addition to setting the direction and strategy for the team.
• Conduct hiring process, capability management and resource management.
• Operational & Technical Expertise:
• Apply a detailed and comprehensive understanding of their coverage areas.
• Contextualize the impact on the wider process and/or system landscape. Act as a go-to for the wider team.
• Acquire a deeper level of understanding where required to appropriately contextualize the impact on the wider organization.
• Risk Landscape Awareness:
• Maintain advanced awareness or knowledge of the broader internal risk landscape across one or more business areas, as well as external risks and developments in specific fields.
• Participate and lead activity planning, setting directions, prioritization and scope for Risk & Control. Set and execute tactical plans whilst maintaining a business need centric and user friendly approach to influence business stakeholders to take informed decisions in line with the risk capacity, risk appetite and risk tolerance of Booking.com.
• Risk & Governance Advisory:
• Actively manage large scale programs, splitting large tasks into logical, manageable activities, and overseeing & coordinating work of teams across departments including setting up and executing structured risk assessment processes.
• Actively drive the development and continued improvement of the ERM framework and methodologies.
• Proactively maintain a risk posture of the business units within your scope, take a leading role for specific topics and raise critical risk items.
• Ensure independent end to end ownership of the risk area/topics in your scope.
• Risk Identification & Assessment:
• Identify and appropriately assess risks in line with the team's frameworks and methodologies.
• Document and/or review the risk assessment outcomes, including clear description of the risk, perceived level of risk and considerations for risk treatment, tailored to the topic at hand, with limited to no guidance or review required.
• Risk Treatment:
• Oversee the development, selection and implementation of risk treatment strategies.
• Coordinate audit activities including support to close any control deficiencies identified.
• Apply a detailed and comprehensive understanding of your coverage areas.
• Contextualize the impact on the wider process and/or system landscape.
• Acts as a go-to for the wider team.

• Relevant Business Unit stakeholders (depending per role) and or process/Control owners (combination of directors, managers, team leaders and individual contributors)
• Subject Matters Experts (SME's) e.g. Security, Fraud, Privacy, Legal, Tax etc.
• Other Internal stakeholders in Accommodations (i.a. CS, PS, Product), Trips, Finance, FinTech, Legal, Marketing, People, Strategy and Corporate Development and Technology (i.a. Security, Infrastructure)
• Internal & External Audit
• Risk Management team

• Persuasion / CooperationPartner with business stakeholders by: giving clear instructions to stakeholders on what is expected of them during collaborative efforts for ongoing compliance;ensuring that actions are followed up and closed out with management or alternatively properly handed over to the business;facilitating and participating in cross functional groups for activities related to the risk management lifecycle;presenting and advising on standardized methodologies, processes and documentation;maintaining a business centric approach.
• Information and CooperationInform SMEs on:risk areas in need of SME input;control design and implementation;work closely together to share knowledge and experience
• CooperationWork closely together to share knowledge and experience.
• CooperationSupport Business units during Operation/other audit cycles;Work with Internal and External audit teams to ensure that remediation plans consider risk appetite;Support SOX, PCI and other audit cycles.
• Information, Cooperation and PersuasionWork closely together to share knowledge and experience;Lead and coordinate team efforts.

• Continuous
• Continuous
• Continuous
• Continuous
• Continuous

• Bachelor degree
• Master degree

• Bachelor degree or higher in a relevant field (f.e. Accounting, Finance, Computer Science, Security, Business, Audit) (Master Degree is preferable)Alternatively compensating years of experience (3 to 5 years in addition to below)
• Preferred

• Extensive Knowledge (8 - 12 years)

• Qualities / Soft Skills:
• Enthusiastic, self-starting and flexible and agile work attitude
• Ability to effectively prioritize and manage workload, work under pressure and deliver on timelines
• Handle multiple tasks, of varying and often complex content, generally at the same/similar time
• Have the ability to split large tasks into logical, manageable and decoupled actions which are managed effectively and delivered on time
• Strongly process, problem solving and action oriented
• Curious and proactive in the assessment and challenge of risks
• Independent & autonomous, while still a strong team player
• Advanced communication and persuasion skills and ability to actively listen and manage conflicts
• Ability to communicate complex technical concepts in a simple manner
• Strong relationship building skills directed at senior stakeholders across the organization
• High level of integrity, confidentiality & professionalism
• Requirements of special knowledge/skills:
• Expert (technical) understanding of and significant operational experience with Risk Management, Compliance, Audit Cycles
• Strong understanding of internal controls and experience in applying them in various business areas/functions
• Advanced project management skills
• Advanced stakeholder management skills
• Experience with large e-commerce or tech companies is advantageous
• CISSP, CRISC, CISM, CISA, or similar advantageous
• Line manager experience
• Fluent in English, both written and spoken
• Advanced understanding of and experience with risk management relevant fields, for example but not limited to:
• Business analysis
• Auditing
• Corporate governance
• Finance concepts and processes
• AML/ CFT framework, GDPR, PCI, SOx
• Intermediate understanding of below IT expertise fields
• IT Risk management and IT Governance
• IT Security concepts and processes
• (IT) Frameworks like ITGC, COSO, NIST
• DevOps tools like Puppet, Jenkins, Git, Docker, or Kubernetes
• JIRA
• Intermediate understanding of above Business expertise fields.