Sr. Manager, Information Risk & Controls

Invesco Ltd. • Houston, TX

3d • Hybrid

About The Position

Invesco is adopting new technologies, strengthening its data strategy, expanding its use of third parties and evolving its operating model to serve clients better. These changes raise the importance of two risk domains in particular: Business Resilience and Data Governance. The Sr. Manager of Information Risk and Controls is the second-line lead for these two domains. Supporting the Global Head of Information Risk and Controls, this individual provides independent oversight and challenge of how the first line identifies, assesses, controls, reports and responds to resilience and data risk, and turns that oversight into clear findings, appetite positions and escalations for senior risk committees. The role works day to day with the Chief Data Office, the Business Resilience and Incident & Crisis management functions, Compliance and Internal Audit, and coordinates with cybersecurity, privacy, technology risk and operational risk specialists, business users, architects and other subject matter experts where a risk crosses functional boundaries. Partnering with a team of subject matter experts, a key strategic focus will be to strengthen the overall risk posture, enhance risk management measures and support independent governance that let the firm evidence its resilience and data risk posture to its management and regulators.

Requirements

• Risk management experience: Typically 8 or more years of relevant risk, control, data governance or assurance experience, including substantial experience in either operational resilience or data governance with demonstrated working capability in the other, gained within or advising regulated financial services institutions. Asset management experience is preferred.
• Business resilience expertise: Demonstrated experience applying operational resilience and business continuity requirements in a regulated environment, including familiarity with current regulatory resilience regimes.
• Data governance expertise: Demonstrated experience assessing or implementing data governance operating models, including accountability, stewardship, classification, data quality, lineage and critical data. Familiarity with recognized data governance or risk data aggregation principles is desirable.
• Incident management experience: Experience reviewing significant incidents, assessing root cause and control failure, and advising on remediation and lessons learned.
• Second-line assessment experience: Experience independently challenging risk and control self-assessments and remediation evidence, and designing or challenging key risk indicators and their thresholds.
• Committee and regulatory reporting: Experience preparing, reviewing and defending risk reporting for senior committees and forming a clear second-line opinion. Experience supporting regulatory examinations or information requests is desirable.
• Communication and influence: Communicates material findings clearly to senior stakeholders, supports conclusions with evidence and secures accountable management responses; provides independent, constructive challenge and proportionate escalation while maintaining effective working relationships.
• Analytical ability: Root-cause thinking on control failures and remediation, distinguishing symptom closure from remediation; comfortable using risk management platforms and analytical tools to assess complex information.
• Leadership: Experience directing or coaching risk professionals, setting priorities and maintaining the quality of team conclusions.
• Emerging technology: Can assess how cloud dependencies, automation and AI-enabled data use affect resilience, data quality, accountability and control effectiveness.
• An undergraduate degree is required; an MBA or master’s degree in a relevant field is preferred.
• A relevant professional qualification in resilience, risk, audit or data governance is desirable (for example CBCI/MBCI, CRISC, CISA, CDMP, CISM).

Nice To Haves

• Asset management experience is preferred.
• Familiarity with recognized data governance or risk data aggregation principles is desirable.
• Experience supporting regulatory examinations or information requests is desirable.
• An MBA or master’s degree in a relevant field is preferred.
• A relevant professional qualification in resilience, risk, audit or data governance is desirable (for example CBCI/MBCI, CRISC, CISA, CDMP, CISM).

Responsibilities

• Business Resilience oversight: Lead second-line oversight of Business Resilience across the firm, including its regulatory operational resilience obligations. Challenge the design and effectiveness of resilience capabilities, recovery arrangements, testing and remediation, and escalate exposures that remain outside appetite.
• Data Governance oversight: Lead second-line oversight of data risk. Challenge the effectiveness of the firm’s data governance framework, its adoption across the business and the progress of remediation and oversee data risks arising from new technology and AI use in coordination with privacy, cybersecurity and model risk specialists and with the business users, architects and other subject matter experts closest to that use.
• Incident & Crisis management Advisory: Review material incidents affecting resilience or data for root cause, control failure and adequacy of response; advise the first line and senior management on lessons learned and remediation; provide independent second-line commentary to management and risk committees; and contribute to the continuing improvement of the firm’s incident & crisis management practices.
• Risk Management Activities: Lead the second-line role in the annual risk and control self-assessment for both domains and produce the rating recommendation for committee. Oversee the risk appetite measures and enhance key risk indicators for both domains, challenging coverage, thresholds and escalation.
• Risk Reporting & Governance: Provide independent review of Business Resilience and Data risk reporting before risk committee submission, present a clear second-line opinion, and challenge risk acceptances, policy exceptions and issue remediation timelines that materially affect either domain.
• Policy, regulatory and industry engagement: Lead the development and periodic review of ERM policies, standards, taxonomy and reporting guidance for the two domains, ensuring appropriate risk oversight and reporting against regional regulatory requirements. Support regulatory engagement on resilience and data governance matters, including examinations and information requests. Engage with industry networks and peers to track developments in resilience and data risk management and bring relevant practice back to the firm.
• Leadership and collaboration: Provide strategic leadership to the analysts supporting both domains, setting priorities, developing capability and remaining accountable for the quality of second-line conclusions. Partner with first-line risk owners, the Chief Data Office, Business Resilience, Compliance and Internal Audit, and with the wider operational & enterprise risk management community, so that oversight of the two domains is coordinated across the three lines and the firm’s risk culture in these areas is strengthened

Benefits

• Flexible paid time off
• Hybrid work schedule
• 401(K) matching of 100% up to the first 6% with a discretionary supplemental contribution
• Health & wellbeing benefits
• Parental Leave benefits
• Employee stock purchase plan

What This Job Offers

• Job Type: Full-time
• Career Level: Manager