A career in risk: the chance of something bad happening to something you care about.

From textbooks to risk

Abda: Risk is part of every professional journey, whether in finance, technology, operations or your own career decisions. Tell us about yourself.

Kiril: I'm originally from Bulgaria and I've lived in Denmark for about 15 years. I started in sales, selling textbooks to schools and universities as a part-time job while I was a student. Then I was a project and product manager for interactive whiteboards, when that was a thing. I had my own startup for a while, moved into IT, and for the past seven years I've worked in risk management in banking. Outside work: Star Trek, improv comedy, and badminton, which I'd like to get back into.

What risk management actually is

Abda: So what is risk management, and what role does it play in organisations today?

Kiril: Some say it's a craft, some a discipline. The textbooks have their definitions, but the simplest way I've found to explain risk is: the chance of something bad happening to something you care about. It fits every situation I've encountered. The management part is using a structured approach to get risks into a manageable state, so the people who make decisions are well equipped to make them.

Abda: You specialise in non-financial risk. What is that?

Kiril: In banking there's the financial side, where outcomes are well defined in monetary terms, and the non-financial side: anything whose outcome isn't directly tied to a number, though it can certainly end up costing money. Think reputational, regulatory or process risk. It needs a structured approach without a precise number at the end. It gives you a ballpark understanding of what can go wrong.

Abda: Why has it become so important?

Kiril: It goes back to people. We're averse to uncertainty, and having some sense of control over it is what drives us towards risk management. Whole industries have learned over the past decades that when you can't manage the uncertainty coming your way, the price can be very high. Practically, when things do go wrong, you can trace back the steps, find where it went wrong and make sure it doesn't happen again.

“Everybody already has risk management experience. Most of us just don't recognise it as such.”

No typical day

Abda: What does a typical day look like?

Kiril: There's no such thing. I work in an advisory role, so decision-makers rely on the information and assessments that I and others provide. That could be about new technology being deployed, processes being optimised, organisational changes, strategic projects, or interactions with regulators. No two days are alike.

Abda: A 2024 survey by the Global Association of Risk Professionals found most respondents expected more risk management opportunities ahead, and most were satisfied in their roles. Are you?

Kiril: Yes. Risk management is a ripe field for exploring the world through the lens of how things can be done better. Technical skills are a plus, but especially on the non-financial side the barrier to entry isn't that high. With everything shifting geopolitically and economically, it's a useful way to frame the challenges people face and approach them in a structured way.

Career paths and skills

Abda: What career paths are there within risk?

Kiril: Advisory, like me: advising on risks, how to measure them and what controls to put in place. Audit, which has real independence and a mandate to review how things are implemented, and needs a different mindset. If you're into numbers, data analysis: there's a lot of data even in non-financial risk. And regulatory interaction, working with internal and external stakeholders as new regulation comes into force.

Abda: Beyond analytical thinking, which skills build the career capital to stand out?

Kiril: First, domain knowledge in some field, whether IT, operations or compliance. Risk management is a frame you apply on top of it. Then critical thinking: questioning whether what's presented makes sense. After that it depends on the role. Advisory needs people skills; control roles need an analytical mindset; governance needs systems thinking. Usually it's a combination of three things: people, process and technology.

Abda: And how do you get experience if you don't already work in risk?

Kiril: Here's the secret: everybody has risk management experience. Imagine I'm crossing the street to the shop. I look both ways because I'm made of flesh and bone and I don't want to be hit by a car. That's mitigation. The car is the threat, my flesh and bone is the vulnerability, and I'm the asset I care about. Now imagine I'm Tony Stark in an Iron Man suit. Do I still have a risk? No, because I've removed the vulnerability. Threat, vulnerability, asset: you can apply that logic to almost anything in your past experience and frame it in risk terms in an interview.

Abda: Which certifications would you recommend?

Kiril: I'm coloured by working in the technology space, so: CISA, Certified Information Systems Auditor; CRISC, for risk and information systems control; and CISM, for information security management. You'll see these abbreviations in job ads. But preferences vary by industry, and most of them require years of proven experience first. They're an add-on that shows you understand the field holistically, once you've chosen your path.

Risk and opportunity

Abda: Managing risk isn't only about preventing problems. Can you share a time risk led to a positive outcome?

Kiril: Moving to Denmark. It was an opportunity: international experience and an education from a highly ranked university. But I don't come from a rich family, and as a newcomer I had to support myself. I knew exactly how much money I had, and that if I didn't find a job within three months I'd have to reconsider everything. So I managed it in a structured way: walking around, knocking on doors, handing out CVs. Sometimes I missed classes to keep my student job. I'm glad I did. There's no free lunch. Everything comes with a price, and the question is whether you can pay it, to what degree, and for how long.

Kiril: When I face challenges, I look at whether they're situational, something about the people, process or technology in front of me, or structural, the constraints of the system itself. Stepping back to see the whole picture stops you getting too discouraged.

Will AI replace the risk manager?

Abda: Final question: in the age of AI, is that a yay or a nay for risk managers?

Kiril: Risk management and AI are very compatible. AI gives fast access to information, which is what risk management deals with. The question is whether you know what to ask, especially with climate, geopolitics and the economy all shifting at once. It doesn't negate the discipline. The output of risk management is a decision, and AI will help us improve the quality of what feeds into it.

Abda: Risk isn't something to fear. It's something to understand, manage and turn into opportunity.