Director, Operational Risk (Business Resiliency Management)

Navy Federal Credit Union•Vienna, VA

1d•$129,500 - $189,400•Onsite

About The Position

Leads and oversees the Business Resiliency Management (BRM) risk function, providing direction in identifying, analyzing, and mitigating BRM risks. Develops and implements risk policies, frameworks, and governance structures to strengthen resilience; leads cross-functional risk initiatives; collaborates with senior executives to promote risk awareness; advises on risk matters; and ensures compliance with regulatory standards. Manages multiple teams and influences risk strategy across business units to advance operational excellence and enterprise risk management maturity. The Director leads the day-to-day execution and ongoing maturity of the enterprise Business Resiliency Management Program. The role has balanced accountability for business continuity and operational resilience, BRM third-party risk assessments, disaster recovery oversight, and cyber resilience. It integrates these capabilities into a cohesive operating model while maintaining appropriate Second Line of Defense (2LOD) oversight, credible challenge, governance, and escalation.

Requirements

Bachelor's degree in Business Administration, Risk Management, Emergency Management, Technology, Cybersecurity, Engineering, Auditing, or a related field, or an equivalent combination of education and experience.
10+ years of progressive experience across business continuity, operational resilience, third-party risk, disaster recovery, cyber resilience, technology risk, operational risk, or related financial services risk disciplines.
Demonstrated experience designing, implementing, or materially enhancing an enterprise business continuity or operational resilience framework, including BIAs, continuity planning, exercises, remediation, governance, and executive reporting.
Demonstrated experience conducting or overseeing resiliency assessments of critical third parties, including continuity and disaster recovery capabilities, dependency and concentration risk, testing evidence, and issue remediation.
Demonstrated experience connecting business recovery requirements to technology disaster recovery capabilities, recovery objectives, dependencies, testing, and evidence.
Practical experience supporting cyber resilience, cyber incident response, crisis management, or cyber disruption exercises and integrating results into sustainable risk remediation.
Strong knowledge of regulatory expectations, industry standards, and risk management practices relevant to business continuity, operational resilience, third-party risk, disaster recovery, and cyber resilience.
Extensive experience with risk governance, analytics, metrics, executive reporting, regulatory engagements, and effective challenge in a First or Second Line of Defense environment.
Exceptional communication, negotiation, and stakeholder management skills, with the ability to translate complex resilience and technology risk concepts into practical expectations for executives and business partners.
Applicants must be authorized to work in the United States without current or future sponsorship.
Remains cognizant of and adheres to Navy Federal policies, procedures, and regulations pertaining to the Bank Secrecy Act.

Nice To Haves

Financial services, enterprise risk management, operational risk, or consulting experience is preferred.
A master's degree or relevant professional certification is a plus.
5+ years of leadership experience directing teams, enterprise programs, or complex cross-functional initiatives.

Responsibilities

Lead execution and continued maturity of the enterprise business continuity and operational resilience framework, including business impact analyses (BIAs), continuity strategies and plans, recovery requirements, exercises, lessons learned, and continuous improvement.
Oversee identification and assessment of critical business services, capabilities, processes, and their people, facilities, technology, data, third-party, upstream, and downstream dependencies to identify vulnerabilities, concentration risks, and potential points of failure.
Provide oversight and effective challenge of business continuity and technology recovery capabilities, ensuring recovery requirements align with disaster recovery strategies, recovery objectives, application and infrastructure dependencies, recovery sequencing, testing, and demonstrated recoverability.
Lead the BRM third-party risk assessment program, evaluating critical third parties and supporting services for resilience, continuity and disaster recovery capabilities, dependency and concentration risks, recovery commitments, testing evidence, and contingency or exit considerations.
Partner with Third-Party Risk Management, Procurement, business owners, Technology, and Information Security to integrate resilience requirements into third-party due diligence, ongoing monitoring, issue management, and material change or renewal decisions.
Lead development and execution of the enterprise cyber resilience framework, connecting business continuity, disaster recovery, technology resilience, cyber incident response, crisis management, and third-party resilience.
Oversee identification, escalation, and remediation of material business continuity, third-party resilience, disaster recovery, and cyber resilience risks and capability gaps, ensuring clear ownership, action plans, milestones, evidence, and sustainable closure.
Develop and enhance BRM governance, policies, standards, metrics, and executive reporting, providing leadership visibility into preparedness, critical dependencies, third-party resilience, recovery capabilities, exercise outcomes, emerging risks, and remediation progress.
Lead and develop the BRM team, set priorities and performance expectations, and build trusted partnerships across business units while preserving the independence and objectivity of a 2LOD risk function.