Risk Manager, EU

As the Risk Manager for Lightspark's Estonian regulated entity, you lead the risk management function of an e-money institution and crypto-asset service provider. You report to the Management Board and own the company's risk management framework end to end, covering risk appetite, key risk indicators, ICT risk under DORA, business continuity, client fund safeguarding, and supervisory reporting. This is a second-line role where you build structure from the ground up, apply independent judgment, and turn regulation into working processes that support sustainable growth.

What you'll do

• Own and develop risk management policies and procedures, including their annual review and risk-related processes embedded across company policies.
• Map the company's key risks to first-line owners, define measurable key risk indicators and set up ongoing risk monitoring.
• Build and maintain the risk and control register with a documented annual review cycle.
• Finalize and run the Risk Appetite Statement, including mapping data sources and reporting quarterly to the Management Board and Supervisory Board for approval.
• Lead company-wide risk assessments for new products, business lines and material changes.
• Develop card payment fraud risk processes with Operations, building on the existing fraud risk policy.
• Lead ICT and security risk management in line with DORA, including the ICT risk register, ICT and information asset registers, vendor register and ICT risk work plan.
• Own business continuity management, keeping the business impact analysis and continuity plan current as new business lines, processes and vendors are added, and run incident management walkthroughs and tabletop exercises with the group information security team.
• Manage ICT third-party risk, including reviewing vendor agreements against DORA requirements and preparing the register of information for supervisory reporting.
• Lead risk-related supervisory reporting, including operational risk and DORA reporting, and prepare the company for supervisory inspections on ICT risk management and crypto-asset custody.
• Oversee finance-related risks, including periodic own funds calculations and projections, secure and highly automated safeguarding account flows without single-person access, and reporting obligations to stablecoin issuer partners.
• Prepare clear risk management reports for the Management Board and Supervisory Board.
• Build a culture of risk awareness by running annual risk training and internal workshops.
• Work with Compliance, AML, Legal, Operations, Product, Engineering and Finance to embed risk management into daily operations.

What you bring

• 3+ years of experience in risk management at a credit institution, e-money institution, payment institution, investment firm or crypto-asset service provider, or equivalent experience in the financial sector or at a public authority.
• Solid knowledge of EU and Estonian risk management regulation and guidelines, including DORA, EBA guidelines on internal governance, ICT and security risk and outsourcing, and own funds and safeguarding requirements under EMD and PSD2.
• Hands-on experience building risk frameworks such as risk appetite statements, key risk indicators, risk and control registers, business impact analyses and business continuity plans.
• A good understanding of ICT risk, information security and third-party risk management.
• Strong project management skills and a structured way of working, with the ability to run several workstreams against regulatory deadlines.
• A proactive attitude and the independence to operate as a second-line function, proposing initiatives and developing new ideas.
• Good communication skills, with the ability to present risk matters to the Management Board and Supervisory Board and explain them in practical terms to non-risk audiences.
• Working proficiency in Estonian and English.
• University degree in finance, economics, business, law or a comparable field preferred.

Nice to have

• Experience working closely with and coordinating communication with the Estonian FSA.
• Knowledge of virtual assets and blockchain technology, crypto-asset custody, card payments and fraud, AML/CFT and sanctions, data protection, or embedded finance and banking-as-a-service setups.

What we offer

• Gross monthly base salary of €4,400-€5,170, determined by experience and skills using objective, gender-neutral criteria.
• Annual performance bonus and equity.
• On-site 5 days per week, full-time, permanent position in Estonia.

About Lightspark

Lightspark is building the Money Grid, modern open financial infrastructure that makes payments accessible, affordable and instant for businesses and users worldwide. The company provides e-money institution and crypto-asset service provider services in Estonia, supporting stable coins, card payments and embedded finance.