Lead – AI Risk Management and Governance

Why USAA?

At USAA, our mission is to empower our members to achieve financial security through highly competitive products, exceptional service and trusted advice. We seek to be the #1 choice for the military community and their families.

Embrace a fulfilling career at USAA, where our core values – honesty, integrity, loyalty and service – define how we treat each other and our members. Be part of what truly makes us special and impactful.

We are proud to support active-duty military spouses. USAA roles may offer remote or hybrid flexibility for active-duty military spouses consistent with applicable policy and business needs.

The Opportunity

AI is creating tremendous opportunities to change how we work and better serve our members. Making sure we do that responsibly is just as important.  At USAA, we’re continuing to strengthen our AI risk management capabilities, and we’relooking for great people to help us.  If you have experience in AI and IT risk management, cybersecurity, model risk management, or technology controls, then this could be the role for you.

We offer a flexible work environment that requires an individual to be in the office 4 days per week. This position can be based in one of the following locations: San Antonio, TX, Plano, TX,  Charlotte, NC, or Remote. Relocation assistance is available for this position.

This role is remote eligible in the continental U.S. with occasional business travel. However, individuals residing within a 60-mile radius of a USAA office will be expected to work on-site four days per week.

Positioned in the first line of defense, this role leverages advanced technical expertise in Information Technology (IT), Cybersecurity, and Information Risk Management to strengthen risk and compliance programs within a technology-focused business operation. This role will partner with business units, Compliance, Risk Management, Audit, and Regulators to identify, assess, and mitigate risks related to the adoption of AI capabilities across the company. Responsible for supporting business and technology leader adherence to the established risk framework and ongoing supervision of business controls and the new enhanced AI risk management frameworks developed by NIST and Cyber Risk Institute for the financial sector and the new OCC Super Intelligence supervisory guidance. 

The implementation of AI capabilities requires an enhancement to our existing risk and control environment across programs to include risk and control self-assessments, identification and evaluation of control effectiveness, identifying control failures, facilitating risk and compliance remediation, internal and external audits and regulatory exams, and monitoring of the first line of defense to minimize risk exposures and strengthen the overall control environment leveraging industry frameworks. This role will partner across business and technology to manage risk assessment data and uses critical thinking to identify key data-driven insights tied to first line of defense, specifically focusing on the identification of trends and patterns related to IT, Cyber, and Data risks.

What you'll do:

• Directs and oversees AI specific Risk Assessment and Management to include but not limited to: Conducting regular risk assessments of IT systems, applications, infrastructure, and data, identifying vulnerabilities and recommending appropriate mitigation strategies. This includes evaluating risks related to cybersecurity, data management, system availability, architectural health and application failures.
• Oversight of AI Risk Management procedures/process, accurate regulatory reporting and filing, document governance, risk control self-assessments, procedure governance, control design, new product controls, Function or Line of Business Third Party Governance, or quality governance.
• Applies a holistic understanding of risk and regulatory compliance to include business strategies and solutions leveraging a deep understanding of information technology, information security, and information management.
• Responsible for first line of defense data analysis, report preparation and trend analysis, utilizing business intelligence tools.
• Designs solutions for unanswered business questions and anticipates future business needs.
• Directs, organizes and oversees action plans designed to enhance risk management practices in alignment with industry frameworks (e.g., ITIL, NIST, TOGAF, COBIT, and CRI).
• Influences and develops innovative solutions to mitigate risk and prevent risk exposures which result in significant business impacts.
• Manages the most complex projects involving cross-functional areas within the first line of defense.
• Defines and outlines new approaches to problem resolution and leads project team from concept through implementation.
• Advises senior management on the status of their control environment related to risk identification and control weaknesses.
• Identifies critical areas to monitor and escalates issues and findings to appropriate stakeholders.
• Serves as a primary resource to cross functional team members and advises on risk mitigation opportunities.
• Stays informed of changes to the regulatory environment to ensure proper compliance with processes and requirements are followed.
• Ensures risks associated with business activities are effectively identified, measured, monitored, and controlled in accordance with risk and compliance policies and procedures.

What you have:

• Bachelor's degree in a related field; OR 4 years of relevant education and/or experience.
• 8 years of experience supporting risk-related, compliance related, or business control design activities; OR 8 years of experience in a relevant quantitative discipline; OR Advanced degree or designation in a risk management, technology, or quantitative discipline, and 6 years of experience supporting risk-related, and/or compliance-related, or business control design activities; OR PhD in a risk management, technology, or quantitative discipline, and 4 years of experience supporting risk-related, and/or compliance-related, or business control design activities.
• 3-5 years of direct experience in technical roles in IT, Information Security, or Information Governance (e.g., systems administration, IT operations, application development, infrastructure support, cloud engineering, information security engineering, IT architecture, information governance).
• Familiarity with key technology and data processes such as change management, access management, SDLC, patching, information governance, sensitive data management and incident management.
• Strong understanding of IT controls and risk management principles, ideally within a financial services or regulated industry context.
• Note: This role requires deep technical expertise in IT, Information Security, and Information Management to support technology and data-centric functions.

What sets you apart:

• Master's degree in Cybersecurity, Computer Science, Data Science, Artificial Intelligence, Information Systems, Risk Management, or a related field.
• Leadership experience at the intersection of Technology Risk, Data Governance, Cybersecurity, Artificial Intelligence, and Operational Risk Management.
• Deep knowledge of data governance disciplines, including data quality, lineage, metadata management, privacy, classification, retention, and ownership frameworks.
• Experience establishing and leading AI Governance, Responsible AI, and Data Risk Management programs within highly regulated environments.
• Expertise assessing and mitigating risks associated with Generative AI, machine learning, advanced analytics, cloud technologies, and emerging technology platforms.
• Experience implementing automated risk, governance, compliance, and continuous control monitoring capabilities to improve oversight, reporting, and risk visibility.
• Strong knowledge of industry frameworks and standards, including NIST AI RMF, NIST CSF, COBIT, ISO 27001, and enterprise data governance practices.
• Experience partnering with regulators, internal audit, risk management, and executive leadership teams to drive regulatory readiness and sustainable remediation outcomes.
• Professional certifications such as CISSP, CISM, CRISC, CGEIT, CDPSE, CIPP, CDMP, AIGP, or equivalent.
• US military experience through military service or a military spouse/domestic partner

Compensation range: The salary range for this position is: $143,320 - $313,820.

USAA does not provide visa sponsorship for this role. Please do not apply for this role if at any time (now or in the future) you will need immigration support (i.e., H-1B, TN, STEM OPT Training Plans, etc.).

Compensation: USAA has an effective process for assessing market data and establishing ranges to ensure we remain competitive. You are paid within the salary range based on your experience and market data of the position. The actual salary for this role may vary by location.

Employees may be eligible for pay incentives based on overall corporate and individual performance and at the discretion of the USAA Board of Directors.

The above description reflects the details considered necessary to describe the principal functions of the job and should not be construed as a detailed description of all the work requirements that may be performed in the job.

Benefits: At USAA our employees enjoy best-in-class benefits to support their physical, financial, and emotional wellness. These benefits include comprehensive medical, dental and vision plans, 401(k), pension, life insurance, parental benefits, adoption assistance, paid time off program with paid holidays plus 16 paid volunteer hours, and various wellness programs. Additionally, our career path planning and continuing education assists employees with their professional goals.

For more details on our outstanding benefits, visit our benefits page on USAAjobs.com.

Applications for this position are accepted on an ongoing basis, this posting will remain open until the position is filled. Thus, interested candidates are encouraged to apply the same day they view this posting.

USAA is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or status as a protected veteran.