VP, Generative AI Risk Oversight

Synchrony•Cincinnati, OH

1d•$110,000 - $185,000•Hybrid

About The Position

The Risk Manager for AI, Generative AI, and Agentic AI works within Synchrony’s Operational Risk Management team in the 2nd Line of Defense (2LOD). The role identifies, assesses, and monitors risks arising from the design, development, deployment, and operation of AI-enabled capabilities, partnering with the AI Solutions team to embed governance, controls, and assurance throughout the AI lifecycle. The position reports to the VP, Information Technology Oversight. The role reviews and assesses AI risk practices and controls across the Information Technology organization, performs or oversees risk assessments, recommends safeguards for generative AI and agentic systems, and partners with model validation, security, privacy, and other teams. It maintains alignment with relevant regulations, internal policies, and standards; evaluates third-party AI vendors; oversees incident response and issue management; and defines metrics for monitoring AI risks. The position also provides risk guidance and training, supports audit readiness, performs formal technology risk reviews and continuous monitoring, independently assesses business risk-taking, represents 2LOD at technology planning sessions including the Responsible AI Working Group, manages risks and issues in the enterprise governance application (eGRC), and supports Enterprise Risk Assessment (ERA) and Risk and Control Self-Assessment (RCSA) processes. Other duties and special projects may be assigned. Synchrony offers flexibility to work from home near a Hub or from an office. Associates are required to commute to their nearest virtual or physical Hub for in-person activities such as business or team meetings, training, and culture events. Business travel may be required. The role is eligible for an annual bonus based on individual and company performance.

Requirements

Bachelor’s degree in Risk Management, Information Systems, Computer Science, Data Science, Engineering, Mathematics/Statistics, Cybersecurity, or a related field, or equivalent practical experience.
At least 6 years of experience in technology risk, model risk management, information security risk, compliance, operational risk, or assurance roles in a regulated bank or financial institution.
At least 1 year supporting AI/ML or data-driven systems, or demonstrably equivalent exposure, in a regulated bank or financial institution.
Working knowledge of supervised and unsupervised learning, evaluation metrics, overfitting, data leakage, bias and fairness concepts, drift, and monitoring.
Understanding of AI failure modes, including hallucinations, prompt injection, data exfiltration, and jailbreaks, and basic RAG architecture.
Familiarity with AI agents that plan and use tools such as APIs, including autonomy risks such as goal misalignment, unsafe actions, and cascading failures, and controls such as scoped tools, approvals, and sandboxing.
Demonstrated experience creating risk assessments, control frameworks, KRIs/KPIs, and remediation plans; ability to explain risks in business terms and quantify impact and likelihood where possible.
Strong ability to produce governance documentation, including policies, standards, procedures, risk assessments, and controls, and present to senior stakeholders.
Evidence of ongoing learning in AI risk, security, privacy, and compliance through courses, workshops, internal enablement, or certifications.
Ability and flexibility to travel for business as required.
Must be at least 18 years old and have a high school diploma or equivalent.
Must be willing to take a drug test, submit to a background investigation, and submit fingerprints as part of onboarding.
Must satisfy the requirements of Section 19 of the Federal Deposit Insurance Act.
Legal authorization to work in the United States is required; employment visa sponsorship is not available for this role.

Nice To Haves

Familiarity with information security and risk management concepts.
Proven analytical skills, attention to detail, and quality control of work product.
Experience in financial services or banking and understanding of the financial services regulatory environment.
Experience in IT operations and/or application support.
Experience with data sourcing and reporting processes and the ability to design and implement new analytical capabilities.
Experience with internal audits and/or regulatory examinations, including preparing evidence, rationale, and responses to external inquiries.
IT project management experience.
Experience working in ambiguous environments and explaining complex concepts while supporting a point of view.
Strong written and oral presentation and communication skills, including experience interacting with all organizational levels.
Experience writing formal reports for senior and executive management.
Interpersonal skills and ability to foster relationships and create informal networks internally and externally.
Curiosity and ability to learn new concepts.
Competencies in risk-based decision-making, stakeholder management, AI/GenAI/Agentic AI technical literacy, writing and policy craftsmanship, facilitation and influence, analytical thinking, incident and issue management, and pragmatic control design.

Responsibilities

Review and assess AI, generative AI, and agentic AI risk management practices and controls in the Information Technology organization, aligning risk management with business objectives and risk appetite.
Perform or oversee AI use case, model, vendor, and process risk assessments; document inherent and residual risk, control effectiveness, and remediation plans.
Recommend safeguards for prompt and response safety, content moderation, jailbreaks, prompt injection, RAG data hygiene, retrieval security, and output verification.
Establish policies and technical controls for agentic AI tool access, authorization, least privilege, action confirmation, rate limiting, sandboxing, memory management, and human approval of high-impact actions.
Partner with Model Validation and Analytics teams to define model validation expectations for performance, robustness, bias and fairness, explainability, and drift, and ensure independent reviews where required.
Coordinate with Security and Privacy teams on data classification, access control, encryption, secrets management, secure SDLC, and privacy-by-design for AI solutions.
Maintain alignment with applicable standards and regulations and keep internal AI policies and procedures current and auditable.
Conduct due diligence on AI vendors, including foundation model, platform, and data providers, considering security posture, data usage terms, intellectual property, and model transparency and documentation.
Oversee incident response, including triage, containment, communications, and lessons learned.
Define and track AI risk metrics, including safety events, policy violations, drift, override rates, hallucination indicators, and agent action errors; report insights to governance forums.
Deliver risk guidance and training to product and engineering teams and promote responsible AI practices and documentation discipline.
Ensure evidence collection, control testing support, and documentation standards for internal audit, regulators, and customer due diligence inquiries.
Perform formal technology risk assessments using Risk Management processes, including Targeted Reviews, Concurrent Reviews, and Continuous Monitoring.
Monitor risks accepted by the business and provide an independent assessment of risk-taking activities.
Attend and represent 2LOD at technology strategic planning sessions, including the Responsible AI Working Group.
Manage risks and issues in Synchrony’s enterprise governance application (eGRC).
Support 2nd Line of Defense processes, including Enterprise Risk Assessment (ERA) and Risk and Control Self-Assessment (RCSA).
Perform other duties and special projects as assigned.