Head of internal control and operational risk
swan.io · Paris, France · hybrid
AboutSwan is Europe’s embedded banking specialist. We empower software companies to embed banking features like accounts, cards, and payments directly into their products, under their own brand.Swan processes over €2.5 billion in monthly transactions for more than 150 companies - like Pennylane, Indy, Agicap, Libeo, and Lucca.
Founded in 2019, the company has received growth capital from leading investors such as Lakestar, Accel, Creandum, Bpifrance and Eight Roads. Swan is a principal member of Mastercard and a licensed financial institution, regulated by the French banking authority (ACPR).
Our missionBanking belongs in business softwareMany software companies already serve small businesses incredibly well: helping them send invoices, run payroll, manage inventory, and more. They’re on a mission to become the central hub for managing every aspect of business life.
But when it comes to financial workflows, there’s still a gap. Too many critical tasks like managing cash flow, tracking payments, or reconciling accounts happen outside the software, across spreadsheets, email threads, banking portals.
It’s a missed opportunity. Business software shouldn’t just record financial activity — it should run it.
To learn more about us: About Swan ; Career.
Job description
✨ SummarySwan is looking for a Head of Internal Control & Operational Risk to lead the day-to-day operation and continuous improvement of its risk management and second-line permanent control frameworks.
Reporting to the Chief Risk & Compliance Officer, you will ensure that Swan identifies, assesses, monitors and manages its material risks within the risk appetite approved by its governing bodies. You will lead the Internal Control team, provide independent challenge to the first line of defence, and give senior management a clear and decision-oriented view of Swan’s risk profile and control environment.
This is a key leadership role at the crossroads of Risk, Compliance, FinCrime, Security, Operations, Finance, Product, Technology and Legal.
The Head of Internal Control & Risk Operational acts as the operational lead of the Operational Risk function and supports the Chief Risk and Compliance (CRCO) in fulfilling the responsibilities associated with that function.
The role holder prepares independent risk assessments, recommendations and escalation proposals for the CRCO and participate in relevant governance committees within the mandate established by the CRCO.
✨ Your missionYour primary mission is to ensure the effective operation of Swan’s operational risk management and permanent control frameworks.
You will ensure that:
- Operational risks are identified, assessed and assigned to accountable owners;
- Swan’s actual risk profile remains consistent with its approved Risk Appetite Framework;
- Controls are risk-based, properly designed and effectively implemented;
- Operational risks are independently monitored;
- Incidents, control deficiencies and recommendations result in timely and sustainable remediation;
- First-line teams receive effective and constructive second-line challenge;
- The CRCO, senior management and governance committees receive reliable, accurate and decision-oriented risk information;
- The Internal Control function oversees and steers the group-wide internal control framework, ensuring that local branch frameworks follow a consistent approach while appropriately reflecting local risks and regulatory requirements.
✨ Main tasks
1. Lead and own the operational risk framework- Operate Swan’s operational risk framework under the authority of the CRCO, maintaining policies, methodologies, risk taxonomies and governance standards.
- Coordinate risk mapping and risk and control self-assessments with accountable first-line owners across France and European branches, covering existing activities, new products, material changes and emerging risks while reflecting local specificities.
- Define the framework for operational incidents, losses and near misses; analyse root causes and other risk signals to identify systemic weaknesses and improve processes, controls and risk indicators.
- Maintain a consolidated, forward-looking view of Swan’s risk profile, independently challenge risk assessments and management decisions, and prepare reporting, recommendations and escalation proposals for the CRCO.
2. Lead group-wide permanent control- Steer Swan’s group-wide permanent control framework and oversee local branch frameworks, establishing common methodologies, clear responsibilities and reporting expectations while incorporating local risks and regulatory requirements.
- Define and execute a risk-based second-line control plan aligned with risk mapping, incidents, audit findings and regulatory priorities; assess control design and effectiveness against robust testing, evidence and closure standards.
- Coordinate branch-level controls, risk indicators and remediation monitoring; challenge first-line owners without taking over their accountability, and escalate material weaknesses, unmanaged exposures and overdue actions to the CRCO.
3. Operate risk appetite, drive remediation and support risk governance- Maintain Swan’s Risk Appetite Framework under the sponsorship and approval of the CRCO, translating it into measurable indicators, thresholds, limits and escalation mechanisms with Compliance, FinCrime and first-line risk owners, and preparing its periodic governance review.
- Monitor the risk profile against approved appetite and tolerances, investigate breaches, challenge management responses and ensure material risks, control deficiencies and breaches are promptly documented, escalated and addressed.
- Consolidate remediation actions from controls, risk assessments, incidents, audits and regulatory inspections; ensure accountable owners, target dates and completion evidence, challenge action plans and validate closure of internal control and risk findings.
- Produce decision-oriented dashboards covering risk mapping, appetite and KRI, controls, operational risks, findings and remediation; highlight overdue or high-risk actions and residual exposure.
- Prepare reporting for the CRCO and relevant governance bodies, support the CRCO’s presentations to senior management and the supervisory body.
4. Lead and develop the team- Lead a team of 4 to 5 professionals covering internal control, operational risk, and remediation monitoring.
- Define clear responsibilities, objectives and development plans.
- Allocate resources according to Swan’s most material risks and regulatory priorities.
- Coach team members and develop their technical expertise, judgement and ability to challenge senior stakeholders.
- Foster a culture of independence, pragmatism, accountability and continuous improvement.
✨ Curious about your future team?You will work closely with Terry and Kani, internal controllers, as well as all members of Swan’s Risk department, to strengthen our internal control framework and foster a shared risk culture across the organization.
You will also collaborate with teams across Swan, including Payments, Sales, Finance, Compliance and more, to support effective risk management in their day-to-day activities.
Preferred experience✨ You’re a great match if:You ave significant experience in internal control, enterprise or operational risk management, audit, or another second-line control function.
You don’t only act as an advisor, you are detailed-oriented and are able to evaluate blind spots. You have a bias to action, you are closed to the field.
You have hands-on experience with risk mapping, RCSA, control plans, control testing, incidents, KRI and remediation and have experience developing or operating a Risk Appetite Framework.
You are data-driven and can turn complex risk information into clear recommendations for executives and committees.
You have successfully led and developed a multidisciplinary team.
You communicate with clarity and c