Sr Manager, Technology Risk Officer

TIAA • Frisco, TX

1d • $117,000 - $159,000

About The Position

The Technology Risk Officer serves as a subject matter expert within the second line of defense (2LoD), responsible for challenging, overseeing, and supporting enterprise IT and cybersecurity risk management programs. The role partners with first line of defense technology and controls teams—including Cybersecurity, Corporate Technology, Nuveen Technology, Wealth Technology, and the Enterprise Vendor Program Office—to monitor, escalate, and report significant risks and control weaknesses.

The officer supports targeted risk assessments to confirm control effectiveness, identify opportunities to strengthen controls, evaluate application- and infrastructure-specific control gaps, identify thematic issues, and develop remediation plans. The role also supports implementation and ongoing maturation of the Risk and Control Self-Assessment program, coordinates with first-line IT risk and control partners, and collaborates with business-aligned control teams to ensure assessments reflect the technology control environment that critical business functions depend on.

The role provides governance and second-line challenge across issue management, including review of issue criticality ratings, action plans, and risk-accepted issues. It supports and challenges TIAA’s Information Technology Policy and IT Standards, including evaluation of proposed policy changes affecting technology teams. The officer also supports management with risk committee materials, metrics reporting, and related analysis, and builds relationships across first-, second-, and third-line teams and control partners.

Requirements

• At least 5 years of experience in one or more of the following: cybersecurity/information security, IT/technology risk management, IT/technology compliance, IT/technology audit, or information technology.

Nice To Haves

• A bachelor’s degree in Information Technology, Cybersecurity, Computer Science, Information Systems, Data Science, or a related IT discipline.
• At least 7 years of experience in cybersecurity/information security, IT/technology risk management, IT/technology compliance, or related fields.
• Working knowledge of industry IT security control frameworks and/or regulations such as NIST, COBIT, ISO, or GDPR.
• Experience with IT controls identification and/or implementation.
• Experience performing risk and control assessments and/or audits across cybersecurity/information security domains.
• Experience with third-party risk management.
• Proficiency with reporting and data tools such as Excel, Tableau, or Archer GRC.
• Professional certifications such as CISSP, CISA, CRISC, CISM, and/or CCSP.

Responsibilities

• Support second-line targeted risk assessments to confirm control effectiveness and identify opportunities to strengthen controls.
• Evaluate application- and infrastructure-specific control gaps, identify thematic issues, and develop remediation plans.
• Support implementation and ongoing maturation of the Risk and Control Self-Assessment (RCSA) program in coordination with first-line IT risk and control partners.
• Collaborate with business-aligned control teams to ensure RCSAs reflect the technology control environment supporting critical business functions.
• Provide governance and second-line challenge across the Issue Management Program.
• Review issue criticality ratings and evaluate whether action plans adequately address identified control gaps.
• Assess risk-accepted issues for adherence to requirements.
• Support and challenge TIAA’s Information Technology Policy and IT Standards, including evaluating proposed policy changes affecting technology teams.
• Support management in producing risk management committee materials, metrics reporting, and related analysis.
• Build and maintain relationships with first-, second-, and third-line teams and control partners; clarify risk program expectations and guide issue and action plan owners as needed.

Benefits

• Superior retirement program.
• Competitive health, wellness, and work-life offerings.
• Comprehensive Total Rewards package supporting physical, emotional, and financial well-being.
• Depending on the role, participation in an incentive program linked to performance may be included.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed