Executive Director, Technology Business Risk and Controls - Data and AI

USAA•San Antonio, NC

3d•Hybrid

About The Position

As the Executive Director, Technology Business Risk & Controls – Data & AI, you will serve as a senior leader within the First Line of Defense, providing strategic direction and oversight of the technology risk and control environment across critical technology functions. In this highly visible role, you will partner with executive technology leaders, business stakeholders, and risk partners to strengthen governance frameworks, enhance control effectiveness, and ensure alignment with risk management objectives and regulatory expectations. You will lead a high-performing team of Business Risk & Controls professionals responsible for identifying, assessing, monitoring, and mitigating risks associated with data, analytics, artificial intelligence, and emerging technologies. This role is accountable for driving association-wide risk and control programs, strengthening regulatory and audit readiness, overseeing issue management and remediation efforts, and advancing governance processes that foster a strong risk culture while enabling innovation, operational excellence, and business growth. As a trusted advisor to senior executives, you will influence strategic decision-making by providing expert guidance on technology risk, control design, regulatory compliance, and the evolving risk landscape surrounding data and AI. Success in this role requires a visionary leader who can effectively balance risk management with business priorities, embedding sustainable and scalable controls that protect the organization while accelerating responsible innovation, resilience, and long-term value creation. We offer a flexible work environment that requires an individual to be in the office 4 days per week. This position can be based in one of the following locations: San Antonio, TX, Plano, TX, Phoenix, AZ, Colorado Springs, CO, Charlotte, NC, or Tampa, FL Relocation assistance is available for this position.

Requirements

Bachelor's degree in Business, Information Technology, Information Security, Information Management, Risk Management, Finance, or a related field.
10 years of progressive experience supporting technology risk, compliance, controls, audit, cybersecurity, information governance, technology operations, or related disciplines within a highly regulated environment, including 5-8 years of direct experience in information technology, information security, data governance, technology operations, infrastructure, engineering, architecture, cloud technologies, or related technical fields.
4 years of direct people leadership experience, including leadership of managers, large teams, or multiple functional areas.
Executive-level knowledge of industry-related regulatory requirements, and operational risk concepts.
Demonstrated experience leading complex, cross-functional risk, controls, governance, remediation, or regulatory initiatives with significant organizational impact.
Strong understanding of technology risk management principles, control frameworks, and industry standards, including NIST, COBIT, ISO 27001, FFIEC guidance, and related regulatory expectations.
Deep knowledge of technology and data processes, including software development lifecycle (SDLC), change management, access management, privileged access controls, vulnerability management, incident management, cloud technologies, operational resiliency, and information governance.
Experience leading or supporting regulatory examinations, internal audits, external audits, issue management, and remediation programs.
Proven ability to leverage data, analytics, and risk intelligence to identify emerging risks, evaluate control effectiveness, and influence risk-based business decisions.
Experience leveraging automation, AI, analytics, and continuous monitoring capabilities to modernize assurance and testing programs.
Exceptional communication, executive presence, and relationship-management skills, with a demonstrated ability to influence senior leaders and build partnerships across Technology, Risk, Compliance, Audit, and Business organizations.

Nice To Haves

Master's degree in Cybersecurity, Computer Science, Data Science, Artificial Intelligence, Information Systems, Risk Management, or a related field.
Executive leadership experience at the intersection of Technology Risk, Data Governance, Cybersecurity, Artificial Intelligence, and Operational Risk Management.
Deep knowledge of data governance disciplines, including data quality, lineage, metadata management, privacy, classification, retention, and ownership frameworks.
Experience establishing and leading AI Governance, Responsible AI, and Data Risk Management programs within highly regulated environments.
Expertise assessing and mitigating risks associated with Generative AI, machine learning, advanced analytics, cloud technologies, and emerging technology platforms.
Experience implementing automated risk, governance, compliance, and continuous control monitoring capabilities to improve oversight, reporting, and risk visibility.
Strong knowledge of industry frameworks and standards, including NIST AI RMF, NIST CSF, COBIT, ISO 27001, and enterprise data governance practices.
Demonstrated success partnering with regulators, internal audit, risk management, and executive leadership teams to drive regulatory readiness and sustainable remediation outcomes.
Exceptional ability to translate complex technology, data, and AI risks into actionable business insights and executive-level recommendations.
Proven track record of building high-performing teams, influencing senior executives, and fostering a culture of accountability, innovation, and risk awareness.
Professional certifications such as CISSP, CISM, CRISC, CGEIT, CDPSE, CIPP, CDMP, AIGP, or equivalent.
US military experience through military service or a military spouse/domestic partner

Responsibilities

Leads the implementation and advancement of Technology Business Risk and Controls programs, operating models, and roadmaps across assigned technology organizations, ensuring alignment with enterprise objectives, risk appetite, and regulatory expectations.
Serves as a trusted advisor to senior technology leaders on information technology, cyber, data, AI, resiliency, and operational risk matters, influencing business decisions and risk mitigation strategies.
Oversees association-scale risk identification, assessment, measurement, monitoring, and control activities related to technology infrastructure, software development, cloud environments, information security, data governance, third-party technology services, and emerging technologies.
Accountable for the design, implementation, and continuous improvement of first-line technology risk and control programs, including risk and control self-assessments, issue management, control monitoring, risk indicators, loss event management, and governance processes.
Partners with senior leaders and key control partners, including Risk Management, Compliance, Audit, Legal, to address complex risk matters, drive remediation efforts, and ensure sustainable control effectiveness.
Leads first-line engagement activities for regulatory examinations, internal audits, external audits, and risk reviews, ensuring timely responses, effective remediation plans, and sustainable issue resolution.
Drives identification of emerging technology, cyber, data, and operational risk themes and systemic control weaknesses through analytics, trend analysis, and industry intelligence, driving proactive mitigation strategies.
Oversees the development, monitoring, and reporting of technology risk metrics and key risk indicators for senior leadership and governance committees to support informed decision-making and risk transparency.
Builds and oversees a high performing team through ongoing execution of recruiting, development, retention, coaching and support, performance management, and managerial activities.
Ensures risks associated with business activities are effectively identified, measured, monitored, and controlled in accordance with risk and compliance policies and procedures.