Technology Risk and Controls Advisor – Lead

Why USAA?

At USAA, our mission is to empower our members to achieve financial security through highly competitive products, exceptional service and trusted advice. We seek to be the #1 choice for the military community and their families.

Embrace a fulfilling career at USAA, where our core values – honesty, integrity, loyalty and service – define how we treat each other and our members. Be part of what truly makes us special and impactful.

We are proud to support active-duty military spouses. USAA roles may offer remote or hybrid flexibility for active-duty military spouses consistent with applicable policy and business needs.

The Opportunity

There are 7 available positions for this Lead role. Of which will be focusing in 3 different roles:

• TECHNOLOGY

• CONTROL TESTING

• INFOSEC

Positioned in the first line of defense, this role leverages deep technical expertise in Information Technology (IT), Information Security, and Information Management to strengthen risk and compliance programs within a technology-focused business operation.

This role will partner with business units, Compliance, Risk Management, Audit, and Regulators to identify, assess, and mitigate risks.

Responsible for supporting business leader adherence to the established risk framework and ongoing supervision of business controls; including, risk and control self-assessments, identification and evaluation of control effectiveness, identifying control failures, facilitating risk and compliance remediation, internal and external audits and regulatory exams, and monitoring of the first line of defense to minimize risk exposures and strengthen the overall control environment leveraging industry frameworks.

Manages risk assessment data and uses critical thinking to identify key data-driven insights tied to first line of defense, specifically focusing on the identification of trends and patterns related to IT, Cyber, and Data risks.

We offer a flexible work environment that requires an individual to be in the office 4 days per week. This position can be based in one of the following locations: San Antonio, TX.

Relocation assistance is not available for this position.

What you'll do:

• Directs and oversees IT Risk Assessment and Management to include but not limited to: Conducting regular risk assessments of IT systems, applications, infrastructure, and data, identifying vulnerabilities and recommending appropriate mitigation strategies. This includes evaluating risks related to cybersecurity, data management, system availability, architectural health and application failures.
• Oversight of procedures/process, accurate regulatory reporting and filing, document governance, risk control self-assessments, procedure governance, control design, new product controls, Function or Line of Business Third Party Governance, or quality governance.
• Applies a holistic understanding of risk and regulatory compliance to include business strategies and solutions leveraging a deep understanding of information technology, information security, and information management.
• Responsible for first line of defense data analysis, report preparation and trend analysis, utilizing business intelligence tools.
• Designs solutions for unanswered business questions and anticipates future business needs.
• Directs, organizes and oversees action plans designed to enhance risk management practices in alignment with industry frameworks (e.g., ITIL, NIST, TOGAF, COBIT).
• Influences and develops innovative solutions to mitigate risk and prevent risk exposures which result in significant business impacts.
• Manages the most complex projects involving cross-functional areas within the first line of defense.
• Defines and outlines new approaches to problem resolution and leads project team from concept through implementation.
• Advises senior management on the status of their control environment related to risk identification and control weaknesses.
• Identifies critical areas to monitor and escalates issues and findings to appropriate stakeholders.
• Serves as a primary resource to cross functional team members and advises on risk mitigation opportunities.
• Stays informed of changes to the regulatory environment to ensure proper compliance with processes and requirements are followed.
• Ensures risks associated with business activities are effectively identified, measured, monitored, and controlled in accordance with risk and compliance policies and procedures.

What you have:

Bachelor's degree in a related field; OR 4 years of relevant education and/or experience.

Experiences that will support your success:

• 8 years of experience supporting risk-related, compliance related, or business control design activities; OR 8 years of experience in a relevant quantitative discipline; OR Advanced degree or designation in a risk management, technology, or quantitative discipline, and 6 years of experience supporting risk-related, and/or compliance-related, or business control design activities; OR PhD in a risk management, technology, or quantitative discipline, and 4 years of experience supporting risk-related, and/or compliance-related, or business control design activities.
• 3-5 years of direct experience in technical roles in IT, Information Security, or Information Governance (e.g., systems administration, IT operations, application development, infrastructure support, cloud engineering, information security engineering, IT architecture, information governance).
• Familiarity with key technology and data processes such as change management, access management, SDLC, patching, information governance, sensitive data management and incident management.
• Strong understanding of IT controls and risk management principles, ideally within a financial services or regulated industry context.
• Note: This role requires deep technical expertise in IT, Information Security, and Information Management to support technology and data-centric functions.

What sets you apart:

TECHNOLOGY:

• Strong technical understanding of IT Operations and SDLC, with the ability to identify technology risks, control gaps, and process weaknesses.
• Deep understanding of infrastructure services, including networks, databases, mainframe, and related technology controls.
• Strong knowledge of Cloud technologies, cloud governance, and associated risk and control requirements.
• Strong understanding of AI and emerging technology risks, with the ability to evaluate and recommend appropriate controls.
• Ability to analyze technology and cyber incidents, identify root causes and control failures, and drive sustainable control improvements.
• Strong technical risk judgment and critical thinking, with the ability to connect risks across processes, applications, infrastructure, cyber, cloud, and AI and make sound control decisions.
• Excellent communication, organization, and prioritization skills, with the ability to manage competing priorities and deliver under tight deadlines; hands-on coding/development experience is a plus.

CONTROL TESTING:

• Quantitative discipline; OR Advanced degree or designation in a risk management, technology, or quantitative discipline, and 8 years of experience supporting risk-related, and/or compliance-related, or business control design activities; OR PhD in a risk management, technology, or quantitative discipline, and 6 years of experience supporting risk-related, and/or compliance-related, or business control design activities.

INFOSEC:

• Deep working knowledge of Information Security domains and common control types, including access management, vulnerability management, encryption, logging and monitoring, incident response, and related technical controls.
• Strong grounding in risk and controls methodology, including RCSA, the distinction between control design and operating effectiveness, root-cause analysis, and issue management.
• Strong risk metrics literacy, with the ability to distinguish genuine risk indicators from performance metrics and define thresholds aligned to risk appetite or tolerance statements.
• Working familiarity with financial-services regulatory expectations relevant to Information Security, including the GLBA Safeguards Rule, FFIEC guidance, NYDFS 23 NYCRR 500, and OCC guidance, with the ability to apply those expectations to control and metric decisions.
• Demonstrated ability to document, challenge, and improve existing risk and control processes rather than simply execute established processes.
• Strong written and verbal communication skills, with the ability to effectively engage control owners, technology leadership, and governance committees.
• Demonstrated experience owning a risk/control portfolio, leading testing engagements, and/or mentoring analysts.
• Industry certification such as CISSP, CISA, or CRISC.
• Prior experience in a First-Line or “1.5 Line” risk function, with an understanding of how oversight and challenge responsibilities differ from independent assurance.
• Depth of experience with one or more recognized Information Security frameworks, including NIST CSF, FFIEC, ISO/IEC 27001, or CIS Controls.
• Experience within a Big 4 firm, Internal Audit, or Second-Line Risk function is a plus.

Compensation range: The salary range for this position is: $143,320 - $273,930

USAA does not provide visa sponsorship for this role. Please do not apply for this role if at any time (now or in the future) you will need immigration support (i.e., H-1B, TN, STEM OPT Training Plans, etc.).

Compensation: USAA has an effective process for assessing market data and establishing ranges to ensure we remain competitive. You are paid within the salary range based on your experience and market data of the position. The actual salary for this role may vary by location.

Employees may be eligible for pay incentives based on overall corporate and individual performance and at the discretion of the USAA Board of Directors.

The above description reflects the details considered necessary to describe the principal functions of the job and should not be construed as a detailed description of all the work requirements that may be performed in the job.

Benefits: At USAA our employees enjoy best-in-class benefits to support their physical, financial, and emotional wellness. These benefits include comprehensive medical, dental and vision plans, 401(k), pension, life insurance, parental benefits, adoption assistance, paid time off program with paid holidays plus 16 paid volunteer hours, and various wellness programs. Additionally, our career path planning and continuing education assists employees with their professional goals.

For more details on our outstanding benefits, visit our benefits page on USAAjobs.com.

Applications for this position are accepted on an ongoing basis, this posting will remain open until the position is filled. Thus, interested candidates are encouraged to apply the same day they view this posting.

USAA is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or status as a protected veteran.