I think that is a false dichotomy, and your CSO is being plain silly.
Though I am fond of the silliness, the security department should be driving risk mitigation. Squabbling over areas of "responsibility" are obviously not productive, though it might fit into the general corporate culture.
While there are various ways of qualifying the realm of security and their responsibility - the CIA triad is one, but there are others - a mature, responsible CSO would at the least be pushing for a solution.
I have heard some say that the distinction between "security risk" and "operational risk" is whether there is a potential threat actor, or merely accidental or misuse.
While this does make a lot of sense, I think a more pragmatic approach would be to simply accept that there is substantial overlap between the two - and that just means there are more resources to work on the problem, not that everybody gets to abdicate responsibility.
That said - in this specific case, the process I would recommend is having the CSO (or technical people in his department) drive the mitigation procedure, define a framework for levels of risk, etc - and then hand it off to operations to implement a fitting solution. Perhaps the security folk can recommend a solution, or maybe they should just define metrics that the solution should meet, depending on how technical / hands-on the team is.
In this way, the company can handle the fact that while the risk is a security risk, the solution is an operational one.