ERM Program Manager

Overview

Hands-on operator role owning the execution of Alpaca's Enterprise Risk Management (ERM) program: intake, risk register maintenance, residual scoring, and board-ready reporting. No direct reports; reports to the CISO / ERM Lead.

What you'll do

• Run the ERM intake cycle end to end, including ticket ingestion, functional interviews, surveys, and ad hoc signals from incidents or operational channels.
• Maintain functional and enterprise risk registers in Vanta: owners, inherent and residual scores, mitigations, and status.
• Coordinate functional risk lead check-ins, chase blockers, and normalize inputs into the enterprise view.
• Map risks to Alpaca's 15 L1 categories and Appendix C L2 subcategories to enterprise scenarios for reporting.
• Apply the ERM Risk Scoring Model and push residual validation with risk owners.
• Track mitigation plans, action owners, target dates, and escalations.
• Define KRIs with data owners; use proxy metrics where instrumentation is still maturing.
• Produce leadership and board ERM materials.
• Support ERM Working Group agendas, minutes, and action tracking.
• Operate the intake triage workflow: score, dedupe, register action.
• Build playbooks and templates for functional leads.
• Support local entity quarterly risk updates and escalation hygiene.
• Surface emerging risks (crypto, AI, multi-jurisdiction) for review.

What you'll need

• Mid-career, roughly 5 to 10 years, in operational risk, ERM, GRC, or compliance program management at a regulated financial institution (broker-dealer, fintech, or capital markets).
• Built or run a risk register from intake through reporting, not framework design only.
• Can coordinate Legal, Compliance, Finance, Product, Security, and Operations stakeholders without direct authority.
• Hands-on GRC platform experience.
• Clear writing: risk statements, executive summaries, board-ready tables.
• SEC / FINRA familiarity or equivalent regulated-environment experience.

Nice to have

• Broker-dealer, clearing, or custody operations context.
• High-growth fintech where you stood up ERM while the business scaled.
• Crypto / digital assets risk register exposure.
• Multi-entity, multi-jurisdiction risk consolidation.
• Jira service desk or structured intake workflow design.
• COSO ERM / ISO 31000 implementation as an operator.
• Prior work drafting board or risk committee reporting.

Details

• Remote, Americas.