Technology Risk and Controls Advisor - Lead

USAA • Tampa, FL

1d • $143,320 - $273,930 • Hybrid

About The Position

USAA is hiring seven Lead-level Technology Risk and Controls Advisor positions across three focus areas: Technology, Control Testing, and Information Security (InfoSec). Positioned in the first line of defense, the role applies technical expertise in information technology, information security, and information management to strengthen risk and compliance programs in technology-focused business operations. The advisor partners with business units, Compliance, Risk Management, Audit, and regulators to identify, assess, and mitigate risk, and supports business leaders’ adherence to the risk framework and ongoing oversight of business controls.

The role works with risk and control self-assessments, control effectiveness, control failures, remediation, audits and regulatory examinations, and first-line monitoring. It also manages assessment data and analyzes trends and patterns involving IT, cyber, and data risks. The position requires a flexible work arrangement with four days per week in the office and is based in San Antonio, Texas. Relocation assistance is unavailable.

The role directs IT risk assessment and management across systems, applications, infrastructure, and data; supports governance and control activities; prepares first-line reporting and analysis; and develops solutions to business questions and future needs. It leads complex cross-functional projects and action plans aligned with industry frameworks, advises senior management on control environments, escalates issues, and helps ensure business risks are identified, measured, monitored, and controlled in accordance with policies and regulatory requirements.

The posting describes specialized qualifications for each focus area. Technology emphasizes IT operations, SDLC, infrastructure, cloud, AI, and technology incident analysis. Control Testing lists additional experience alternatives in risk, compliance, or business control design. InfoSec emphasizes security controls and frameworks, risk and control methodology, regulatory expectations, risk metrics, portfolio ownership, and testing or mentoring experience.

The salary range is $143,320–$273,930. Actual pay may vary by location and experience; employees may also be eligible for performance-based incentives. USAA does not provide visa sponsorship for this role.

Requirements

• Bachelor’s degree in a related field, or four years of relevant education and/or experience.
• For the general experience pathway: eight years supporting risk-related, compliance-related, or business control design activities; or eight years in a relevant quantitative discipline.
• Alternatively, an advanced degree or designation in a risk management, technology, or quantitative discipline and six years supporting risk-related, compliance-related, or business control design activities; or a Ph.D. in one of those disciplines and four years of such experience.
• Three to five years of direct technical-role experience in IT, Information Security, or Information Governance, such as systems administration, IT operations, application development, infrastructure support, cloud engineering, information security engineering, IT architecture, or information governance.
• Familiarity with technology and data processes such as change management, access management, SDLC, patching, information governance, sensitive data management, and incident management.
• Strong understanding of IT controls and risk management principles; financial services or regulated-industry experience is relevant.
• Technology focus: strong understanding of IT operations and SDLC; infrastructure services including networks, databases, and mainframe; cloud technologies and governance; and AI and emerging technology risks.
• Technology focus: ability to analyze technology and cyber incidents, identify root causes and control failures, and drive sustainable improvements; sound technical risk judgment and critical thinking; and strong communication, organization, and prioritization skills.
• Control Testing focus: experience alternatives include a quantitative discipline; or an advanced degree or designation in risk management, technology, or a quantitative discipline and eight years supporting risk-related, compliance-related, or business control design activities; or a Ph.D. in one of those disciplines and six years of such experience.
• InfoSec focus: deep working knowledge of Information Security domains and controls, including access management, vulnerability management, encryption, logging and monitoring, and incident response.
• InfoSec focus: strong grounding in risk and controls methodology, including RCSA, control design versus operating effectiveness, root-cause analysis, and issue management.
• InfoSec focus: strong risk-metrics literacy, including distinguishing risk indicators from performance metrics and defining thresholds aligned with risk appetite or tolerance statements.
• InfoSec focus: familiarity with financial-services Information Security regulatory expectations, including the GLBA Safeguards Rule, FFIEC guidance, NYDFS 23 NYCRR 500, and OCC guidance, and ability to apply them to controls and metrics.
• InfoSec focus: ability to document, challenge, and improve existing risk and control processes; communicate effectively with control owners, technology leadership, and governance committees; and experience owning a risk/control portfolio, leading testing engagements, and/or mentoring analysts.

Nice To Haves

• Hands-on coding or development experience.
• InfoSec focus: industry certification such as CISSP, CISA, or CRISC.
• InfoSec focus: prior experience in a first-line or “1.5 Line” risk function and understanding of how oversight and challenge differ from independent assurance.
• InfoSec focus: experience with recognized Information Security frameworks such as NIST CSF, FFIEC, ISO/IEC 27001, or CIS Controls.
• InfoSec focus: experience within a Big 4 firm, Internal Audit, or a Second-Line Risk function.

Responsibilities

• Direct and oversee IT risk assessments of systems, applications, infrastructure, and data, including identification of vulnerabilities and recommended mitigation strategies.
• Oversee procedures and processes, regulatory reporting and filing, document and procedure governance, risk and control self-assessments, control design, new product controls, third-party governance, and quality governance.
• Apply knowledge of risk and regulatory compliance, business strategies, information technology, information security, and information management.
• Conduct first-line data analysis, prepare reports, and analyze trends using business intelligence tools.
• Design solutions to answer business questions and anticipate future business needs.
• Direct, organize, and oversee action plans that enhance risk management practices in alignment with industry frameworks such as ITIL, NIST, TOGAF, and COBIT.
• Develop and influence solutions to mitigate risk and prevent exposures that could significantly affect the business.
• Manage complex projects involving cross-functional areas within the first line of defense.
• Define approaches to problem resolution and lead project teams from concept through implementation.
• Advise senior management on the status of the control environment, risk identification, and control weaknesses.
• Identify critical areas to monitor and escalate issues and findings to appropriate stakeholders.
• Serve as a resource to cross-functional team members and advise on risk mitigation opportunities.
• Monitor regulatory changes and help ensure compliance with applicable processes and requirements.
• Ensure business risks are identified, measured, monitored, and controlled in accordance with risk and compliance policies and procedures.

Benefits

• Comprehensive medical, dental, and vision plans.
• 401(k) and pension.
• Life insurance.
• Parental benefits and adoption assistance.
• Paid time off, including paid holidays and 16 paid volunteer hours.
• Wellness programs.
• Career path planning and continuing education.
• Employees may be eligible for pay incentives based on corporate and individual performance and at the discretion of the USAA Board of Directors.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior