Senior Risk Analyst (Data Risk)

Navy Federal Credit Union•Vienna, VA

15h•$96,900 - $141,600•Onsite

About The Position

This senior individual-contributor role sits in the First Line of Defense and translates enterprise risk, data governance, technology, information security, privacy, and records management requirements into practical execution for HR. Workstream leadership, executive reporting, and decision support make up the largest share of the work, alongside risk assessment and governance analysis. You will own assigned work independently and produce management-ready deliverables with limited rework. Deep expertise across every risk discipline is not expected.

Requirements

Five or more years of progressively responsible experience in risk management, operational or technology risk, information security risk, data governance, compliance, audit, controls, risk transformation, or a related discipline; or an equivalent combination of education and experience.
Demonstrated risk and control judgment — applying risk identification, control objectives, evidence, issues, remediation, exceptions, and escalation in practice, not familiarity with the concepts alone.
Demonstrated experience independently leading complex projects, assessments, workstreams, or cross-functional initiatives through to defined outcomes.
Proven ability to assess materiality, organize ambiguous or incomplete information, and develop practical, proportionate recommendations.
Strong project-management skills across milestones, dependencies, actions, risks, decisions, and competing priorities.
Advanced PowerPoint skills for executive-ready presentations, and strong Excel skills with experience building dashboards, scorecards, or management reporting.
Strong written and verbal communication, with the ability to translate complex risk, business, or technical information into clear, concise language.
Strong facilitation and stakeholder-management skills, including working across organizational boundaries.
Sound judgment handling highly sensitive and confidential information.
Ability to work independently while recognizing when a matter requires escalation, additional expertise, or a management decision.

Nice To Haves

HR risk, employee data, or another domain governed by heightened confidentiality, employment law, and/or privacy constraints
Financial services or another highly regulated industry
First Line of Defense risk management
RCSA, issue management, control assessments, or risk transformation
Data governance, data quality, reporting, or records management
Identity and access management, or data sharing and transfer risk
Third-party or vendor risk
Cloud, analytics, or AI governance
Power BI and/or comparable visualization tools; Azure DevOps, Jira, or comparable work-management tools; SharePoint; Microsoft Copilot or other approved AI productivity tools

Responsibilities

Lead HR data risk assessments, reviews, and governance activities, and analyze what enterprise policies, standards, and controls mean for HR processes, applications, reporting, analytics, vendors, and technology.
Assess materiality and recommend proportionate responses grounded in control objectives, business impact, and applicable requirements.
Evaluate control objectives, evidence, ownership, dependencies, issues, exceptions, and remediation; identify gaps, inconsistencies, emerging risks, and unresolved questions.
Frame complex issues into clear management decisions with options, tradeoffs, and a recommended path forward — not just a list of problems.
Escalate material risk decisions, unresolved ownership, exceptions, significant dependencies, and matters requiring formal governance or management acceptance.
Work spans access and information security; data governance, quality, and reporting; data sharing, lifecycle, and records management; third-party and vendor risk; and analytics, AI, cloud, and emerging technology.
Independently lead the risk analysis and execution coordination for assigned HR Data Risk projects and workstreams.
Turn ambiguous assignments into clear outcomes, milestones, actions, dependencies, deliverables, and definitions of completion.
Distinguish governance, oversight, and decision responsibilities from execution owned by business, technology, vendor, or enterprise partners — and surface dependencies rather than absorbing work that belongs elsewhere.
Coordinate across HR, Technology, Risk, and other enterprise partners; facilitate working sessions, document decisions and actions, and drive follow-up.
Identify blockers, changing requirements, ownership gaps, and competing priorities, and escalate appropriately.
Right-size scope where practical minimum requirements still maintain appropriate risk coverage.
Build polished, visually effective presentations, dashboards, scorecards, and portfolio reporting for management and executive audiences.
Synthesize complex, fragmented, or incomplete information into clear analysis, recommendations, and decision materials.
Translate detailed workstream information into concise leadership narratives focused on what changed, why it matters, and what decision or action is required — covering risk posture, key risks and dependencies, operational impact, upcoming milestones, and recommendations.
Analyze across workstreams to surface trends, recurring issues, emerging risks, and capacity or dependency concerns requiring management attention.
Review risk documentation, presentations, dashboards, and trackers for accuracy, completeness, consistency, and unsupported conclusions before materials advance.
Build reusable templates, trackers, playbooks, and decision tools, and identify opportunities to automate, standardize, or simplify recurring reporting, tracking, and evidence collection.