Director, Technology Risk & Operational Resilience

First Command Financial Services•Fort Worth, TX

2d•Hybrid

About The Position

The Director, Technology Risk & Operational Resilience is a senior leader within Enterprise Risk Management responsible for leading the Company’s technology risk, third-party risk management, and business resiliency teams. The role provides independent oversight and effective challenge of related first-line risk management activities. Reporting to the SVP, Chief Risk Officer, the Director establishes governance and risk oversight frameworks, monitors exposure against approved risk appetite and tolerances, evaluates interconnected and emerging risks, and provides decision-oriented insights to executive leadership and the Board. The Director oversees enterprise risk practices related to technology, critical third parties, operational resilience, business continuity, crisis preparedness, and disaster recovery. The role partners with Technology, Information Security, Operations, Procurement, Legal, Compliance, Internal Audit, and business leadership to promote clear risk ownership, timely escalation, effective remediation, and resilience of critical business services. The Director supervises IT risk management staff, including the third-party risk management, business resiliency, and technology risk management teams.

Requirements

Bachelor’s degree in computer science, Information Systems, or a related field.
12+ years of progressive experience across technology risk, operational risk, cybersecurity risk, third-party risk management, business continuity, disaster recovery, or operational resilience, with demonstrated depth in multiple disciplines.
5+ years of leadership experience managing enterprise-wide risk programs and professional staff.
Experience within a regulated financial services organization, including banking, wealth management, broker-dealer, advisory, insurance, or asset management businesses.
Demonstrated experience interacting with executive leadership, Board committees, regulators, and auditors.
Experience establishing or materially advancing risk frameworks, governance, reporting, and program maturity.
Ability to provide credible, independent challenge while maintaining constructive relationships with senior leaders and first-line risk owners.
Ability to synthesize complex technology, third-party, and resilience information into clear risk conclusions and actionable executive insights.
Strong knowledge of technology risk, cybersecurity risk, operational resilience, third-party risk, business continuity, disaster recovery, and enterprise risk management principles.
Ability to evaluate interconnected risks and dependencies across legal entities, business lines, technologies, processes, facilities, and service providers.
Strong executive communication, governance, negotiation, and influencing skills.
Sound judgment in escalating material risks, tolerance breaches, control weaknesses, and unresolved remediation.
Ability to lead specialized teams, establish priorities, manage capacity, and develop talent.
Ability to operate effectively in a complex, regulated, and evolving financial services environment.
Proficiency with risk management platforms, data visualization tools, and Microsoft 365 applications.

Nice To Haves

Master’s degree.
Certified Information Systems Auditor (CISA).
Certified Information Systems Security Professional (CISSP).
Professional Risk Manager (PRM).
Certified Risk Manager (CRM).
Certification in Risk Management Assurance (CRMA).
Certified in Risk and Information Systems Control (CRISC).
Certified Information Security Manager (CISM).

Responsibilities

Lead the second-line technology risk function and enterprise third-party risk management and business resiliency teams, providing independent oversight and effective challenge of first-line technology, cybersecurity, business continuity, crisis management, and disaster recovery capabilities.
Challenge first-line risk assessments, control activities, remediation plans, and risk acceptance decisions.
Provide independent oversight of material technology exposures, including cybersecurity, cloud services, data and technology dependencies, artificial intelligence, technology transformation, and end-of-life or unsupported platforms.
Provide an independent risk perspective on significant technology investments, architecture decisions, system implementations, cloud migrations, acquisitions, and material changes to critical services.
Evaluate technology risk exposures against approved risk appetite statements and tolerance thresholds; monitor emerging technology risks and industry trends; and advise executive leadership on potential impacts.
Oversee technology risk metrics, key risk indicators, and executive reporting.
Lead enterprise third-party risk management governance and oversight, including risk-tiering standards, due diligence requirements, ongoing monitoring, issue escalation, reporting, and challenge of third-party risk decisions.
Define roles and accountability among business relationship owners, Procurement, Information Security, Legal, Compliance, and the third-party risk management function throughout the third-party lifecycle.
Provide independent challenge and oversight of vendor risk assessments, due diligence, ongoing monitoring, and remediation efforts.
Oversee risks associated with critical third-party service providers, strategic partners, cloud service providers, and outsourced business operations; monitor concentration, fourth-party, and critical supplier dependency risks.
Assess third-party risk practices against regulatory expectations, industry standards, and organizational risk appetite; escalate material risks and control weaknesses to executive leadership and governance committees.
Establish and oversee the enterprise operational resilience framework, including critical business services, key dependencies, disruption tolerances, and severe-but-plausible scenarios.
Lead the business resiliency and crisis preparedness program, including business impact analyses, continuity planning, exercises, and enterprise event readiness.
Provide independent oversight and challenge of Technology-owned disaster recovery strategies, recovery capabilities, testing results, and remediation plans.
Assess interconnected dependencies across people, processes, technology, facilities, data, and third parties, and aggregate continuity, disaster recovery, crisis management, and third-party resilience results into an enterprise view.
Establish and maintain governance frameworks, policies, standards, and reporting processes supporting technology risk, third-party risk, and operational resilience.
Monitor compliance with applicable regulatory expectations and industry guidance, including banking, securities, insurance, and advisory regulations; support regulatory examinations, independent reviews, and internal and external audits.
Advise the Chief Risk Officer on emerging risks, regulatory developments, and strategic risk implications; develop and maintain risk appetite metrics, escalation thresholds, and Board-level monitoring indicators.
Ensure material risk issues, emerging threats, and tolerance breaches are appropriately escalated.
Prepare executive-level risk insights and presentations for management committees, executive leadership, the Risk Management Committee, and the Board of Directors.
Communicate trends, emerging risks, risk concentrations, resilience concerns, and program maturity assessments; provide independent risk perspectives on significant technology initiatives, acquisitions, vendor relationships, and strategic business initiatives.
Support enterprise risk reporting and integrate technology, third-party, and resilience risks into the broader Enterprise Risk Management framework.
Lead, mentor, and develop a high-performing team of risk professionals; establish performance objectives and professional development plans; foster effective challenge, accountability, collaboration, and continuous improvement; and drive maturity and capability enhancements.
Supervise all job activities of IT risk management staff, including the third-party risk management, business resiliency, and technology risk management teams.