Executive Director, Technology Business Risk and Controls - Data and AI

USAA•Tampa, FL

5d•$169,880 - $305,780•Hybrid

About The Position

The Executive Director, Technology Business Risk and Controls – Data and AI is a senior leader within the First Line of Defense, providing strategic direction and oversight of the technology risk and control environment across critical technology functions. The role partners with executive technology leaders, business stakeholders, and risk partners to strengthen governance frameworks, enhance control effectiveness, and align risk management with regulatory expectations. The position leads a high-performing team responsible for identifying, assessing, monitoring, and mitigating risks related to data, analytics, artificial intelligence, and emerging technologies. It oversees association-wide risk and control programs, regulatory and audit readiness, issue management and remediation, and governance processes that support a strong risk culture while enabling innovation, operational excellence, and business growth. As a trusted advisor to senior executives, the Executive Director provides guidance on technology risk, control design, regulatory compliance, and the evolving risks surrounding data and AI. The role balances risk management with business priorities and advances sustainable, scalable controls that protect the organization while supporting responsible innovation, resilience, and long-term value creation. The work environment requires four days per week in the office. The role may be based in San Antonio, Texas; Plano, Texas; Phoenix, Arizona; Colorado Springs, Colorado; Charlotte, North Carolina; or Tampa, Florida. Relocation assistance is available.

Requirements

Bachelor's degree in Business, Information Technology, Information Security, Information Management, Risk Management, Finance, or a related field.
10 years of progressive experience supporting technology risk, compliance, controls, audit, cybersecurity, information governance, technology operations, or related disciplines within a highly regulated environment.
5–8 years of direct experience in information technology, information security, data governance, technology operations, infrastructure, engineering, architecture, cloud technologies, or related technical fields.
4 years of direct people leadership experience, including leadership of managers, large teams, or multiple functional areas.
Executive-level knowledge of industry-related regulatory requirements and operational risk concepts.
Demonstrated experience leading complex, cross-functional risk, controls, governance, remediation, or regulatory initiatives with significant organizational impact.
Strong understanding of technology risk management principles, control frameworks, and industry standards, including NIST, COBIT, ISO 27001, FFIEC guidance, and related regulatory expectations.
Deep knowledge of technology and data processes, including SDLC, change management, access management, privileged access controls, vulnerability management, incident management, cloud technologies, operational resiliency, and information governance.
Experience leading or supporting regulatory examinations, internal and external audits, issue management, and remediation programs.
Ability to use data, analytics, and risk intelligence to identify emerging risks, evaluate control effectiveness, and influence risk-based business decisions.
Experience using automation, AI, analytics, and continuous monitoring to modernize assurance and testing programs.
Exceptional communication, executive presence, and relationship-management skills, with the ability to influence senior leaders and build partnerships across Technology, Risk, Compliance, Audit, and Business organizations.

Nice To Haves

Master's degree in Cybersecurity, Computer Science, Data Science, Artificial Intelligence, Information Systems, Risk Management, or a related field.
Executive leadership experience at the intersection of Technology Risk, Data Governance, Cybersecurity, Artificial Intelligence, and Operational Risk Management.
Deep knowledge of data governance disciplines, including data quality, lineage, metadata management, privacy, classification, retention, and ownership frameworks.
Experience establishing and leading AI Governance, Responsible AI, and Data Risk Management programs within highly regulated environments.
Expertise assessing and mitigating risks related to Generative AI, machine learning, advanced analytics, cloud technologies, and emerging technology platforms.
Experience implementing automated risk, governance, compliance, and continuous control monitoring capabilities to improve oversight, reporting, and risk visibility.
Strong knowledge of industry frameworks and standards, including NIST AI RMF, NIST CSF, COBIT, ISO 27001, and enterprise data governance practices.
Demonstrated success partnering with regulators, internal audit, risk management, and executive leadership to drive regulatory readiness and sustainable remediation outcomes.
Ability to translate complex technology, data, and AI risks into actionable business insights and executive-level recommendations.
Proven track record of building high-performing teams, influencing senior executives, and fostering accountability, innovation, and risk awareness.
Professional certifications such as CISSP, CISM, CRISC, CGEIT, CDPSE, CIPP, CDMP, AIGP, or equivalent.
US military experience through military service or as a military spouse/domestic partner.

Responsibilities

Lead implementation and advancement of Technology Business Risk and Controls programs, operating models, and roadmaps across assigned technology organizations, aligned with enterprise objectives, risk appetite, and regulatory expectations.
Advise senior technology leaders on information technology, cyber, data, AI, resiliency, and operational risk matters and influence business decisions and risk mitigation strategies.
Oversee association-scale risk identification, assessment, measurement, monitoring, and control activities for technology infrastructure, software development, cloud environments, information security, data governance, third-party technology services, and emerging technologies.
Design, implement, and continuously improve first-line technology risk and control programs, including risk and control self-assessments, issue management, control monitoring, risk indicators, loss event management, and governance processes.
Partner with senior leaders and Risk Management, Compliance, Audit, and Legal to address complex risk matters, drive remediation, and ensure sustainable control effectiveness.
Lead first-line engagement for regulatory examinations, internal audits, external audits, and risk reviews; ensure timely responses, effective remediation plans, and sustainable issue resolution.
Identify emerging technology, cyber, data, and operational risk themes and systemic control weaknesses using analytics, trend analysis, and industry intelligence, and drive proactive mitigation strategies.
Oversee development, monitoring, and reporting of technology risk metrics and key risk indicators for senior leadership and governance committees.
Build and oversee a high-performing team through recruiting, development, retention, coaching, performance management, and other managerial activities.
Ensure business risks are effectively identified, measured, monitored, and controlled in accordance with risk and compliance policies and procedures.

Benefits

Comprehensive medical, dental, and vision plans.
401(k) and pension.
Life insurance.
Parental benefits and adoption assistance.
Paid time off program, including paid holidays and 16 paid volunteer hours.
Wellness programs.
Career path planning and continuing education.
Executive-level long-term incentive plan cash payment that is time- and performance-based.
Potential pay incentives based on overall corporate and individual performance, at the discretion of the USAA Board of Directors.
Relocation assistance is available.