Alpaca - ERM Program Manager

• This is a hands-on operator role. You will update risk registers yourself, run functional risk lead check-ins, and produce board materials. No direct reports. • Alpaca has the ERM framework, taxonomy, and scoring model. As ERM Program Manager, you will own execution: intake from functional risk leads, risk register hygiene, residual scoring with risk owners, and board-ready reporting on schedule. You report to the CISO / ERM Lead and work closely with the ERM Working Group, functional risk leads, and local entity leaders. • Things You Get To Do • Run the ERM intake cycle end to end: Ticket ingestion, functional interviews, surveys, and ad hoc signals from incidents or operational channels. • Maintain functional and enterprise risk registers in Vanta: owners, inherent and residual scores, mitigations, and status. • Coordinate functional risk lead check-ins, chase blockers, and normalize inputs into the enterprise view. • Map risks to Alpaca's 15 L1 categories and Appendix C L2 subcategories to enterprise scenarios for reporting. • Track mitigation plans, action owners, target dates, and escalations. • Define KRIs with data owners; use proxy metrics where instrumentation is still maturing. • Produce leadership and board ERM materials. • Support ERM Working Group agendas, minutes, and action tracking. • Operate the intake triage workflow: score, dedupe, register action. • Build playbooks and templates for functional leads. • Support local entity quarterly risk updates and escalation hygiene. • Surface emerging risks (crypto, AI, multi-jurisdiction) for review.