Executive Director, IT/IS Risk Management & Governance

USAA•Charlotte, NC

1d•$169,880 - $305,780•Hybrid

About The Position

The Executive Director of IT/IS Risk Management & Governance advises on IT and information security strategic and aggregate risks across the business and advances Enterprise Risk Management capabilities for risk aggregation, quantification, and qualification. The role sets direction for IT and IS risk management programs and leads their delivery across the line of business. It provides risk management and governance leadership and operational oversight across Information Security, Business Continuity, Physical Security, and Corporate Investigations, while establishing an Enterprise Security Group framework for comprehensive oversight across the risk taxonomy. The Executive Director ensures risks remain within appetite tolerances and align with strategic goals, product plans, and forecasts. The role aggregates and reports risks to senior leadership, assesses and influences business decisions, and contributes to long-term strategies for adapting and integrating risk systems amid regulatory change and new technologies. It ensures appropriate policies, procedures, and controls support risk processes and systems; builds relationships with senior business leaders; and engages business leaders to address risks in accordance with policy and Risk Appetite. The role partners with senior risk executives, Risk Management, Finance, and business leaders to manage risk appetite, define methods, metrics, and limits, challenge variances, and develop mitigation strategies. It advises business partners on risk-and-reward decisions and works with Compliance and the CLO on legal and regulatory considerations affecting operations and products. The Executive Director influences governance for risk oversight, engages product and channel leaders on complex processes, and supports regulatory interactions and Board- and senior-management-level reporting concerning IT/IS risk. The position also builds and oversees a team, including recruiting, developing, retaining, coaching, and managing performance. The position requires working in the office four days per week and may be based in San Antonio, Texas; Plano, Texas; Phoenix, Arizona; Charlotte, North Carolina; or Tampa, Florida. USAA does not provide visa sponsorship for this role.

Requirements

Bachelor's degree, or four years of relevant education and/or experience.
10 years of risk management, regulatory, or operations experience in a functional area such as insurance, banking, or financial services, including at least five years focused on Information Security, Business Continuity, Physical Security, or Corporate Investigations.
Four years of people leadership experience building, managing, and/or developing high-performing teams.
Industry certification(s) in Information Security (e.g., CISSP, CISM), Business Continuity (e.g., ABCP, CBCP), Risk Management (e.g., CRISC), or Physical Security (e.g., CPP).
Proven experience working with and applying Risk, Security, or Audit frameworks such as FFIEC, COBIT, COSO, ISO 27001/2, NIST 800-53, or SSAE16.
Knowledge of laws, rules, and regulations applicable to financial institutions.
Experience making data-driven decisions.
Experience working with external agencies and regulators.
Broad knowledge of information technology systems and general system development principles.

Nice To Haves

Deep cybersecurity and technology risk expertise, supported by a relevant certification such as CISSP or CRISC; other applicable Information Security, Business Continuity, Risk Management, or Physical Security certifications such as CISM, ABCP, CBCP, or CPP are also valued.
Strong command of technology risk frameworks and governance, including RCSA, risk taxonomy, control design and assessment, and oversight of technology policies, standards, and frameworks.
Credibility as a second-line risk partner and challenger, with the ability to engage first-line Technology leaders and LOB CROs and translate complex IT/IS risks into clear business implications and effective risk decisions.
Forward-looking risk management experience using data, automation, and AI to strengthen controls, improve risk identification and monitoring, and create scalable risk-management processes.
US military experience through military service or as a military spouse/domestic partner.

Responsibilities

Recognize and report IT and IS strategic and aggregate risks across the business, advancing Enterprise Risk Management for risk aggregation, quantification, and qualification.
Set direction for IT and IS risk management programs and oversee their delivery across the line of business.
Provide risk management and governance leadership and operational oversight for Information Security, Business Continuity, Physical Security, and Corporate Investigations.
Establish an Enterprise Security Group risk management framework that provides comprehensive oversight across the risk taxonomy.
Ensure risks align with appetite tolerances, strategic goals, product plans, and forecasts, and respond to variances.
Aggregate and report risks to senior leadership and assess and influence business decisions and direction.
Contribute to long-term strategy for adapting and integrating risk systems in response to regulatory change and emerging technologies.
Ensure effective policies, procedures, and controls support risk processes, systems, strategies, and implementations.
Build trust with senior business leaders and engage line-of-business leaders to ensure risks are addressed in accordance with policy and Risk Appetite.
Partner with senior risk executives to manage risk appetite and identify and define key methods, metrics, and limits.
Partner across Risk Management, Finance, and the business; challenge variances to plans and strategies for mitigating risk.
Advise business partners and drive decisions that assess risk and reward through effective challenge.
Liaise with Compliance and the CLO on legal and regulatory considerations affecting business operations and product offerings.
Influence governance structures for oversight of risks and business operations and engage product and channel leaders on complex processes and procedures.
Assist with regulatory interactions and briefings involving the OCC, Federal Reserve, FDIC, and CFPB; prepare Board- and senior-management-level reports on IT/IS risk.
Build and oversee a team, including recruiting, development, retention, coaching, support, performance management, and other managerial activities.

Benefits

Comprehensive medical, dental, and vision plans
401(k)
Pension
Life insurance
Parental benefits
Adoption assistance
Paid time off program with paid holidays
16 paid volunteer hours
Wellness programs
Career path planning and continuing education
Executive-level Long Term Incentive Plan cash payment, which is time- and performance-based
Employees may be eligible for pay incentives based on overall corporate and individual performance and at the discretion of the USAA Board of Directors