Executive Director, IT/IS Risk Management & Governance

USAA•Charlotte, NC

3d•$169,880 - $305,780•Onsite

About The Position

The Executive Director of IT/IS Risk Management & Governance advises on identification and reporting of strategic and aggregate IT and information security risks across the business, while advancing Enterprise Risk Management capabilities for aggregating, quantifying, and qualifying risks. The role sets direction for IT and IS risk management programs and leads their delivery across the line of business. The position provides leadership and operational oversight across Information Security, Business Continuity, Physical Security, and Corporate Investigations. It establishes a comprehensive Enterprise Security Group risk management framework, oversees risks across the risk taxonomy, and ensures risk positions align with appetite tolerances and strategic goals. The Executive Director aggregates and reports risks to senior leaders, influences business decisions, and contributes to long-term strategies for adapting and integrating risk systems in response to regulatory change and new technologies. This role partners with senior leaders across the enterprise, Risk Management, Finance, Compliance, and the business to maintain second-line oversight, challenge plans and variances, and advise on risk and reward. It engages with legal and regulatory stakeholders, including the CLO, and supports interactions with regulators such as the OCC, FED, FDIC, and CFPB. The role also prepares Board- and senior-management-level IT/IS risk reports and builds and oversees a team through recruiting, development, retention, coaching, and performance management. The work environment is flexible but requires four days per week in the office. The position may be based in San Antonio, Plano, Phoenix, Charlotte, or Tampa. USAA does not provide visa sponsorship for this role.

Requirements

Bachelor's degree, or four years of relevant education and/or experience.
10 years of risk management, regulatory, or operations experience in insurance, banking, financial services, or a related functional area, including at least five years focused on Information Security, Business Continuity, Physical Security, or Corporate Investigations.
Four years of people leadership experience building, managing, and/or developing high-performing teams.
Industry certification in Information Security (such as CISSP or CISM), Business Continuity (such as ABCP or CBCP), Risk Management (such as CRISC), or Physical Security (such as CPP).
Experience applying risk, security, or audit frameworks such as FFIEC, COBIT, COSO, ISO 27001/2, NIST 800-53, or SSAE16.
Knowledge of laws, rules, and regulations applicable to financial institutions.
Experience making data-driven decisions.
Experience working with external agencies and regulators.
Broad knowledge of information technology systems and general system development principles.

Nice To Haves

Deep cybersecurity and technology risk expertise, supported by a relevant certification such as CISSP or CRISC; other applicable Information Security, Business Continuity, Risk Management, or Physical Security certifications are also valued.
Strong command of technology risk frameworks and governance, including RCSA, risk taxonomy, control design and assessment, and oversight of technology policies, standards, and frameworks.
Credibility as a second-line risk partner and challenger who can engage first-line Technology leaders and LOB CROs and translate complex IT/IS risks into clear business implications and effective risk decisions.
Forward-looking approach to risk management, with experience using data, automation, and AI to strengthen controls, improve risk identification and monitoring, and scale risk-management processes.
US military experience through military service or as a military spouse/domestic partner.

Responsibilities

Recognize and report strategic and aggregate IT and IS risks across the business, advancing Enterprise Risk Management risk aggregation, quantification, and qualification.
Set direction for IT and IS risk management programs and oversee delivery across the line of business.
Lead risk management and governance for Information Security, Business Continuity, Physical Security, and Corporate Investigations, and establish an Enterprise Security Group risk management framework.
Ensure risks align with risk appetite tolerances, strategic goals, product plans, and forecasts, and respond to variances.
Aggregate and report risks to senior leadership and assess and influence business decisions and direction.
Contribute to long-term strategies for adapting and integrating risk systems, and ensure appropriate policies, procedures, and controls support risk processes and implementations.
Build relationships with senior business leaders and engage line-of-business leaders to ensure risks are addressed in accordance with policy and Risk Appetite.
Partner with senior risk executives to manage risk appetite and define key methods, metrics, and limits; influence advancement of the risk management framework.
Partner with Risk Management, Finance, and business teams; challenge variances and mitigation strategies; and advise business partners on risk and reward.
Liaise with Compliance and the CLO on legal and regulatory considerations, and influence governance for risks and business operations.
Engage product and channel leaders on complex processes and procedures while accounting for legal and regulatory requirements.
Support interactions and briefings with OCC, FED, FDIC, and CFPB regulators, and prepare IT/IS risk reports for the Board and senior management.
Build and oversee a team, including recruiting, development, retention, coaching, support, performance management, and other managerial activities.