Sr. Vice President, Cybersecurity, IT and AI Governance, Risk, and Compliance

Howard Hughes•The Woodlands, TX

About The Position

The Sr. Vice President, Cybersecurity, IT and AI Governance, Risk, and Compliance owns the Company’s cybersecurity program and technology risk oversight, including AI and IT. This position continuously improves these capabilities, translates technology risk into business decisions, and advises executive leadership and the Audit Committee. Reporting to the Chief Information Officer, the position collaborates with technology teams, business leaders, control owners, vendors, and managed-service partners to maintain scalable, measurable, and business-aligned cybersecurity and governance programs spanning privacy and regulatory compliance, third-party risk, security policy, and resilience. This role enables innovation, modernization, and business growth through informed risk decisions and appropriate safeguards.

Requirements

Bachelor’s degree in a relevant discipline; master’s degree preferred.
15+ years of progressive cybersecurity, technology risk, IT governance, compliance, audit, or related leadership, including significant enterprise-level responsibility.
Executive leadership of integrated cybersecurity and IT GRC programs in complex, distributed, or highly outsourced environments.
Broad expertise across security architecture, application security, cloud, security operations, threat intelligence, vulnerability management, incident response, resilience, recovery, IT SOX, privacy, and third-party risk.
Demonstrated ability to lead material incidents, crisis communications, regulatory coordination, post-incident reviews, and corrective-action programs.
Strong executive communication skills, with the ability to translate technical issues into business implications, options, recommendations, and decisions for leadership teams, boards, auditors, regulators, customers, and partners.
Track record managing budgets, portfolios, vendors, managed services, organizational design, distributed teams, and succession planning while integrating cybersecurity into acquisitions and major transformations.
Strong judgment, executive presence, collaboration, negotiation, and influence, with the ability to make sound decisions amid uncertainty and operate effectively in a fast-moving, highly visible environment.

Nice To Haves

Preferred certifications include CISSP, CISM, CRISC, CISA, CGRC, or comparable credentials; relevant executive leadership may substitute for a specific certification.

Responsibilities

Lead a risk-based cybersecurity strategy, governance framework, operating model, roadmap, and investment priorities aligned with business objectives.
Assess cybersecurity maturity, control effectiveness, organizational capabilities, and resource needs; convert findings into measurable improvement priorities.
Establish policies, standards, accountability structures, and performance measures that adapt to changing business, technology, regulatory, and threat requirements.
Advise executive leadership, the Audit Committee, and the Board on cybersecurity posture, material risks, resilience, emerging threats, and recommended actions.
Collaborate with HHX Innovation, Business, Technology, Legal, and Risk stakeholders to establish and maintain an enterprise AI governance model, architecture, risk assessments, responsible-use standards, vendor oversight, monitoring, and accountability.
Own the IT GRC framework, including IT SOX, internal controls, risk assessments, control testing, audit readiness, remediation, risk acceptance, and management reporting.
Ensure technology and cybersecurity risks are documented, prioritized, assigned to accountable owners, and managed to resolution, with strong evidence quality and data-protection practices.
Maintain alignment with NIST CSF 2.0, NIST AI 600-1 and applicable legal, regulatory, contractual, privacy, and industry requirements.
Set strategic direction across security architecture and engineering, application and product security, identity, cloud, threat intelligence, vulnerability management, security operations, detection and response, and recovery.
Oversee the cybersecurity operating model, control lifecycle, managed services, security tooling, awareness, and measurable risk-reduction outcomes.
Lead the response to material cybersecurity incidents, coordinating containment, recovery, executive decisions, business continuity, stakeholder communications, and regulatory engagement as required.
Sponsor tabletop and recovery-readiness exercises and drive post-incident reviews, corrective actions, lessons learned, and continuous improvement.
Embed cybersecurity and GRC requirements into enterprise architecture, application development, cloud adoption, procurement, project delivery, technology change, and operational processes.
Govern risk across vendors, affiliates, service providers, and technology integrations through due diligence, contractual requirements, ongoing monitoring, and remediation.
Ensure cybersecurity and GRC are integrated into acquisitions, divestitures, major transformations, and emerging-technology initiatives.
Balance security, customer experience, operational resilience, delivery speed, and business enablement through clear risk decisions and practical safeguards.
Own the cybersecurity and IT GRC budget, portfolio, resource strategy, managed-service model, and investment recommendations.
Build a high-performing, distributed organization through workforce planning, leadership development, performance management, succession planning, and organizational design.
Provide concise reporting on risk, threats, control performance, resilience, regulatory developments, business impact, and strategic investments.
Represent the Company with auditors, regulators, customers, strategic partners, and other external stakeholders, coordinating authorized communications with relevant leaders.