Eighteen Years in the Room Where Risk Meets Reality

Why a GRC professional in Saudi Arabia’s financial sector decided to start writing on Medium.

I almost didn’t write this.

For eighteen years, I’ve worked behind the scenes in boardrooms, audit committees, regulator meetings, late-night incident calls, and core banking transformations. The kind of work that rarely makes a headline, but quietly determines whether a bank stays trusted, compliant, and resilient.

I am a Senior Manager in Governance, Risk, and Compliance. For most of my career, I believed my job was to do the work not to talk about it.

I’m changing my mind. Here’s why.

The Question That Won’t Leave Me

Around year fifteen, a question began surfacing in nearly every engagement I led:

“Why do we keep solving the same problems in the same way, when the world around us has fundamentally changed?”

I watched banks invest millions in compliance frameworks that produced beautiful documents but couldn’t answer a regulator’s simplest question with verifiable data.

I watched skilled professionals burn out reconciling spreadsheets, when the platform underneath their core banking already held the answers in real time.

I watched leadership teams treat risk, technology, and finance as separate kingdoms when regulators, customers, and threats had long since stopped respecting those boundaries.

The problem isn’t a lack of frameworks. It’s a lack of integration between people who understand finance, people who understand risk, and people who understand the technology that now runs everything.

That intersection is where I’ve chosen to build my career. It’s what I’ll be writing about here.

A Brief Honest Introduction

My name is Imran Jalil. I’m a Senior Manager in Governance, Risk, and Compliance at one of Saudi Arabia’s largest banking Group.

Over eighteen years, I’ve worked across banking, finance, tax, audit, consultancy, blockchain, AI product development, and SAP-ERP. Along the way, I earned five chartered qualifications ACMA, CA (England & Wales), CA (ICAP) CIPFA-UK. I hold SAP S/4HANA certification both in FICO and IBM certifications in Blockchain and Data Science. I also earned highest badge level 4 from IBM as superstar.

But qualifications are receipts, not a story. What I want to lead with is the work and what it has taught me.

What the Work Has Taught Me

The $5.2 billion data quality gap. I once led a remediation that closed a multi-billion-dollar reporting gap in three months. The lesson wasn’t technical. Most risk failures are not failures of intelligence they are failures of ownership. When no one feels accountable for the integrity of a number, the number drifts.

The $1.2 billion disclosure correction. Correcting $1.2 billion in disclosures for the Central Bank took weeks technically. The cultural workconvincing a complex organization that surfacing the error was strength, not weakness took months. Compliance is a culture problem dressed in technical clothing.

Leading a core banking transformation. Risk-focused enhancements during a major upgrade taught me that technology projects fail not because of the technology, but because risk and finance leaders are consulted too late usually after the architecture is already locked in.

Mentoring seven professionals into managerial roles in three years. This sounds soft. It isn’t. The biggest risk facing our industry isn’t regulation or technology it’s the quiet erosion of institutional knowledge as experienced professionals retire faster than we can replace them. Mentoring is risk management.

What I’ll Be Writing About

I plan to write about five things and only these five, at least to start:

1. GRC in the real world : not textbook GRC, but the version involving regulators, boards, vendors, and the awkward conversations no one writes about.

2. Regulatory frameworks that matter: SAMA, BCBS 239, DORA, FFIEC, NCA, ITGF. What they actually require, not what consulting decks claim.

3. Banking transformation, honestly told : core banking upgrades, digital onboarding, AI deployments. The successes, the failures, and the patterns I keep seeing.

4. The platforms beneath modern banking: I’ve grown increasingly focused on IBM Z and IBM LinuxONE, not because they’re fashionable, but because they remain the silent backbone of much of the world’s regulated financial infrastructure.

5. Leadership at the intersection of risk, finance, and technology : the career-defining challenge of our decade is not picking a lane. It’s learning to operate across all three.

Why I’m Writing Publicly Now

For most of my career, I assumed someone else more senior, more visible would write the things I wished existed. The practical playbook for GRC professionals. The honest reflections on what core banking transformations actually feel like from inside. The bridge between traditional finance qualifications and the new world of AI governance.

I waited. Those articles didn’t appear.

So I’ve decided to stop waiting.

I don’t claim to have all the answers. I claim only this: eighteen years of doing the work, in some of the most regulated environments in the world, has given me a perspective worth sharing. If one risk professional, one young auditor, one banking technology leader finds something useful here the writing will have earned its place.

An Invitation

If you work in any corner of this world risk, compliance, audit, banking technology, regulatory affairs, financial transformation, I’d like to hear from you.

What are you wrestling with right now? What’s the question your team keeps asking that no framework seems to answer?

Drop it in the comments, or message me directly. The best writing I’ll do here will be the writing you help me shape.

Welcome to the conversation.

• Imran Jalil Riyadh, Saudi Arabia

Eighteen years at the intersection of risk, finance, and the technology that now runs everything.