Technology Risk and Controls Advisor - Senior

USAA•Tampa, FL

1d•$114,080 - $218,030•Hybrid

About The Position

USAA is hiring for three Senior Technology Risk and Controls Advisor positions focused on Technology, Control Testing, or InfoSec. Positioned in the first line of defense, the role uses advanced expertise in information technology, information security, and information management to strengthen risk and compliance programs within a technology-focused business operation. The advisor partners with business units, Compliance, Risk Management, Audit, and regulators to identify, assess, and mitigate risk. The role supports business leaders’ adherence to the established risk framework and ongoing supervision of business controls. This includes risk and control self-assessments, evaluating control effectiveness, identifying control failures, facilitating risk and compliance remediation, supporting audits and regulatory examinations, and monitoring first-line activities to reduce risk exposure and strengthen the control environment. The advisor manages risk-assessment data and uses analysis to identify trends and patterns related to IT, cyber, and data risks. The position requires working in the office four days per week and can be based in San Antonio, Texas. Relocation assistance is not available. The salary range is $114,080–$218,030, with actual pay varying by location, experience, and market data. Employees may be eligible for performance-based incentives. USAA does not provide visa sponsorship for this role.

Requirements

Bachelor’s degree in a related field, or four years of relevant education and/or experience.
One of the following experience/education combinations: six years supporting risk-related, compliance-related, or business control design activities; six years in a relevant quantitative discipline; an advanced degree or designation in risk management or a quantitative discipline plus four years supporting risk-related, compliance-related, or business control design activities; or a PhD in risk management or a quantitative discipline plus two years in those activities.
Three to five years of direct technical experience in IT, Information Security, or Information Governance, such as systems administration, IT operations, application development, infrastructure support, cloud engineering, information security engineering, IT architecture, or information governance.
Familiarity with technology and data processes such as change management, access management, SDLC, patching, information governance, sensitive data management, and incident management.
Strong understanding of IT controls and risk management principles, ideally in financial services or another regulated industry.
Deep technical expertise in IT, Information Security, and Information Management to support technology- and data-centric functions.

Nice To Haves

Technology focus: Strong understanding of IT operations and SDLC, including identifying technology risks, control gaps, and process weaknesses.
Technology focus: Deep understanding of infrastructure services, including networks, databases, mainframe, and related technology controls.
Technology focus: Strong knowledge of cloud technologies, cloud governance, and associated risk and control requirements.
Technology focus: Strong understanding of AI and emerging-technology risks and the ability to evaluate and recommend appropriate controls.
Technology focus: Ability to analyze technology and cyber incidents, identify root causes and control failures, and drive sustainable control improvements.
Technology focus: Strong technical risk judgment and critical thinking to connect risks across processes, applications, infrastructure, cyber, cloud, and AI and make sound control decisions.
Technology focus: Excellent communication, organization, and prioritization skills; ability to manage competing priorities and deliver under tight deadlines. Hands-on coding or development experience is a plus.
Control Testing focus: The posting additionally lists a quantitative discipline, or an advanced degree or designation in risk management, technology, or a quantitative discipline plus six years supporting risk-related, compliance-related, or business control design activities, or a PhD in one of those disciplines plus four years supporting those activities.
InfoSec focus: Deep working knowledge of Information Security domains and common controls, including access management, vulnerability management, encryption, logging and monitoring, and incident response.
InfoSec focus: Strong grounding in risk and controls methodology, including RCSA, control design versus operating effectiveness, root-cause analysis, and issue management.
InfoSec focus: Strong risk-metrics literacy, including distinguishing risk indicators from performance metrics and defining thresholds aligned with risk appetite or tolerance statements.
InfoSec focus: Familiarity with financial-services regulatory expectations for Information Security, including the GLBA Safeguards Rule, FFIEC guidance, NYDFS 23 NYCRR 500, and OCC guidance.
InfoSec focus: Demonstrated ability to document, challenge, and improve existing risk and control processes.
InfoSec focus: Strong written and verbal communication skills for engaging control owners, technology leadership, and governance committees.
InfoSec focus: Experience owning a risk/control portfolio, leading testing engagements, and/or mentoring analysts.
InfoSec focus: Industry certification such as CISSP, CISA, or CRISC.
InfoSec focus: Prior experience in a First-Line or “1.5 Line” risk function and understanding of how oversight and challenge differ from independent assurance.
InfoSec focus: Experience with recognized Information Security frameworks such as NIST CSF, FFIEC, ISO/IEC 27001, or CIS Controls.
InfoSec focus: Experience within a Big 4 firm, Internal Audit, or Second-Line Risk function.

Responsibilities

Manage IT risk assessment and management, including assessing IT systems, applications, infrastructure, and data; identifying vulnerabilities; and recommending mitigation strategies for risks such as cybersecurity, data management, system availability, architectural health, and application failures.
Oversee procedures and processes, regulatory reporting and filing, document governance, risk and control self-assessments, procedure governance, control design, new-product controls, third-party governance, or quality governance.
Apply a holistic understanding of risk and regulatory compliance, business strategies, and solutions, supported by advanced knowledge of IT, information security, and information management.
Perform first-line data analysis, report preparation, and trend analysis using business intelligence tools.
Design solutions to answer business questions and anticipate future business needs.
Translate control deficiencies into action plans that improve risk management practices in alignment with frameworks such as ITIL, NIST, TOGAF, and COBIT.
Develop and influence innovative solutions to mitigate risk and prevent exposures that could significantly affect the business.
Define new approaches to problem resolution and serve as a primary project team member from concept through implementation.
Advise senior management on the status of the control environment, including risk identification and control weaknesses.
Identify critical areas to monitor and escalate issues and findings to appropriate stakeholders.
Serve as a primary resource for cross-functional team members and advise on risk mitigation opportunities.
Stay informed about regulatory changes and ensure applicable processes and requirements are followed.
Ensure business risks are identified, measured, monitored, and controlled in accordance with risk and compliance policies and procedures.