Senior Director, Integrated Risk Management

VSP Vision Care; United States; Remote; USD 126,000 - 192,000; Full time

Benefits offered by this job

Bonuses and commissions

Job summary

VSP Vision Care is seeking a senior leader to drive Enterprise Risk Management and Business Resilience. You will advance an integrated risk framework across the enterprise, oversee risk assessment, issue management, and resilience, and coordinate assurance models across the three lines of defense.

This role reports to executive leadership and interfaces with the Board. The position requires deep experience in ERM, business continuity, crisis management, and internal audit, along with a track

Qualifications

• Bachelor’s degree in related field, such as Risk Management, Finance, Business, etc. or equivalent experience.
• Minimum of 6 years of management experience in risk, audit, or compliance.
• 5 years of experience specifically within a Second Line of Defense capacity in a complex organization preferred.
• Direct experience across Enterprise Risk Management, Business Continuity, Crisis Management, and Internal Audit.
• Experience building, deploying, and working in an aligned assurance model with the three lines of defense model as the foundation.
• Experience in industries: insurance, manufacturing, supply chain, retail, and technology.
• Experience presenting to and working with a Board and an Audit and Risk Committee.
• Experience in a matrixed organization that operates as an ecosystem.
• Experience in strategic risk management, coordinating between enterprise risk, corporate strategy, and enterprise transformation.
• Deep understanding of global risk profiles, emerging risks, and interdependencies.
• For roles that are remote or hybrid, must demonstrate engagement in virtual environments.

Responsibilities

• Lead and grow the Enterprise Risk Management and Business Resilience teams, covering enterprise risk, business continuity, and crisis management.
• Set direction and standards of work.
• Build depth so the function does not depend on any one person.
• Own career development for the team and create the exposure that makes development real.
• Advocate for the team across the enterprise, so their work is visible to leadership and to business partners.
• Put the integrated risk framework into operation across the enterprise, covering enterprise risk assessment, issue management and resilience, and land it in all four pillars and every enterprise function.
• Run the assessment lifecycle on its established cadence: the full enterprise cycle, the alternate-year refresh, quarterly maintenance, and targeted assessments triggered by events.
• Improve the program continuously.
• Strengthen what works, close gaps as they surface, and fold small improvements into routine work instead of holding them for a separate initiative.
• Protect the integrity of the framework in use. One taxonomy, one scoring scale, one register, one issue standard, applied the same way in every entity and function.
• Build the enterprise risk appetite and tolerance framework with business and finance leadership, then put appetite monitoring into practice against it.
• Provide independent oversight of First Line risk activity, with the challenge and the support that makes business leaders accountable for their own risk profiles.
• Advise pillar and function leaders on decisions where risk matters: strategic shifts, transactions, product launches, operational change.
• Give the First Line the tools, guidance, and training to carry its own risk and control responsibilities.
• Rebuild stakeholder confidence in the function. Plain language, inside the cycles the business already runs, and a closed loop on every input received.
• Run business continuity and crisis management on the value chain resilience model, built around value streams, critical processes, and dependencies instead of individual assets.
• Own incident classification and escalation, so events are recognized against a defined threshold rather than by someone’s judgment in the moment.
• Direct the exercise and testing program
• Make sure findings drive systemic control improvement instead of closing as isolated actions
• Keep the enterprise dependency register and the loss scenario library current as exposure changes
• Coordinate the Aligned Assurance Model for the function, bringing assurance activity into one synchronized plan and a shared view of the control environment
• Partner with Internal Audit on testing schedules and shared assessment data, so Second Line monitoring informs Third Line planning
• Work across information security, compliance, privacy, quality, and health and safety to align calendars, issue handling, and reporting
• Cut assessment and audit fatigue by simplifying how information is collected from the business and reported to governance committees
• Lead strategic risk management
• Identify the risks that threaten enterprise strategic objectives, and surface the planning assumptions carrying risk the register has not captured
• Coordinate between Enterprise Risk Management and Corporate Strategy, so risk input arrives while decisions are still open
• Partner with enterprise transformation initiatives. Bring a risk and resilience view to major programs, integrations and platform changes from the start
• Support scenario and stress analysis, including severe scenarios that routine scoring underweights, and feed the results into strategic and capital planning
• Turn risk and resilience information into reporting that executives and the Board can act on
• Present to governance committees, the Board and the Audit and Risk Committee, and hold up under questioning
• Track regulatory developments and emerging exposure, including artificial intelligence, geopolitical and supply chain risk, and climate, and keep the framework current against them

Education

Bachelor’s degree in related field (Risk Management, Finance, Business) or equivalent experience

Job description

Leads the Enterprise Risk Management and Business Resilience teams. The role is accountable for putting integrated risk framework into operation across the enterprise, running it, and improving it over time. This role will take the framework, taxonomy, scoring methodology, impact matrix, and resilience model to all four pillars and every enterprise function, running the assessment and resilience cycles, and building the discipline that keeps them working. The role sits in the Second Line of Defense, and it advises First Line business leaders while holding the independent oversight a governance function requires. It also coordinates the Aligned Assurance Model on behalf of the function, bringing assurance activity into one plan.

Lead and grow the Enterprise Risk Management and Business Resilience teams, covering enterprise risk, business continuity, and crisis management

Set direction and standards of work

Build depth so the function does not depend on any one person

Own career development for the team and create the exposure that makes development real

Advocate for the team across the enterprise, so their work is visible to leadership and to business partners

Put the integrated risk framework into operation across the enterprise, covering enterprise risk assessment, issue management and resilience, and land it in all four pillars and every enterprise function

Run the assessment lifecycle on its established cadence: the full enterprise cycle, the alternate-year refresh, quarterly maintenance, and targeted assessments triggered by events

Improve the program continuously

Strengthen what works, close gaps as they surface, and fold small improvements into routine work instead of holding them for a separate initiative

Protect the integrity of the framework in use. One taxonomy, one scoring scale, one register, one issue standard, applied the same way in every entity and function

Build the enterprise risk appetite and tolerance framework with business and finance leadership, then put appetite monitoring into practice against it

Provide independent oversight of First Line risk activity, with the challenge and the support that makes business leaders accountable for their own risk profiles

Advise pillar and function leaders on decisions where risk matters: strategic shifts, transactions, product launches, operational change

Give the First Line the tools, guidance, and training to carry its own risk and control responsibilities

Rebuild stakeholder confidence in the function. Plain language, inside the cycles the business already runs, and a closed loop on every input received

Run business continuity and crisis management on the value chain resilience model, built around value streams, critical processes, and dependencies instead of individual assets

Own incident classification and escalation, so events are recognized against a defined threshold rather than by someone’s judgment in the moment

Direct the exercise and testing program

Make sure findings drive systemic control improvement instead of closing as isolated actions

Keep the enterprise dependency register and the loss scenario library current as exposure changes

Coordinate the Aligned Assurance Model for the function, bringing assurance activity into one synchronized plan and a shared view of the control environment

Partner with Internal Audit on testing schedules and shared assessment data, so Second Line monitoring informs Third Line planning

Work across information security, compliance, privacy, quality, and health and safety to align calendars, issue handling, and reporting

Cut assessment and audit fatigue by simplifying how information is collected from the business and reported to governance committees

Lead strategic risk management

Identify the risks that threaten enterprise strategic objectives, and surface the planning assumptions carrying risk the register has not captured

Coordinate between Enterprise Risk Management and Corporate Strategy, so risk input arrives while decisions are still open

Partner with enterprise transformation initiatives. Bring a risk and resilience view to major programs, integrations and platform changes from the start

Support scenario and stress analysis, including severe scenarios that routine scoring underweights, and feed the results into strategic and capital planning

Turn risk and resilience information into reporting that executives and the Board can act on

Present to governance committees, the Board and the Audit and Risk Committee, and hold up under questioning

Track regulatory developments and emerging exposure, including artificial intelligence, geopolitical and supply chain risk, and climate, and keep the framework current against them

__

Job Specifications

Typically has the following skills or abilities:

Bachelor’s degree in related field, such as Risk Management, Finance, Business, etc. or equivalent experience; Minimum of 3 additional years of experience related to functional area

Minimum of 6 years of management experience in risk, audit, or compliance

5 years of experience specifically within a Second Line of Defense capacity in a complex organization preferred

Direct experience across Enterprise Risk Management, Business Continuity, Crisis Management, and Internal Audit. We want someone who has run these, not only designed them

Experience building, deploying, and working in an aligned assurance model with the three lines of defense model as the foundation

Experience in the following industries: insurance, manufacturing, supply chain, retail, and technology

Experience presenting to and working with a Board and an Audit and Risk Committee

Experience in a matrixed organization that operates as an ecosystem, where influence and partnership matter more than direct authority

Experience in strategic risk management, and in coordinating between enterprise risk, corporate strategy, and enterprise transformation

Deep understanding of global risk profiles, emerging risks, and interdependencies

For roles that are remote (i.e., Work From Home (WFM)) or hybrid (i.e., partial onsite at a VSP location and WFM), must demonstrate a high level of engagement in virtual environments, including maintaining camera presence during meetings to support effective communication and team alignment

Working Conditions

The working environment is generally favorable, lighting and temperature are adequate, and there are no hazardous or unpleasant conditions caused by noise, dust, etc.

The above information on this description has been designed to indicate the general nature and level of work performed by employees within this classification. It is not designed to contain or be interpreted as a comprehensive inventory of all duties, responsibilities, and qualifications required of employees assigned to this job grade

#LI-VISIONCARE

Compensation range for the role is listed below. Applicable salary ranges may differ across markets. Actual pay will be determined based on experience and other job-related factors permitted by law. As a part of the compensation package, this role may include eligible bonuses and commissions. For more information regarding VSP Vision benefits, please

Salary Ranges: $126,000.00 - $191,625.00

VSP Vision is an equal opportunity employer and gives consideration for employment to qualified applicants without regard to age, gender, race, color, religion, sex, national origin, disability or protected veteran status. We maintain a drug-free workplace and perform pre-employment substance abuse testing.

Unincorporated LA County Residents: Qualified Applicants with arrest or conviction records will be considered for employment in accordance with the Los Angeles County Fair Chance Ordinance for Employers and the California Fair Chance Act, and any other similar laws.

As a regular part of doing business, VSP Vision (“VSP”) collects many different types of personal information, including protected health information, about our audiences, including members, doctors, clients, brokers, business partners, and employees. VSP Vision employees will have access to this sensitive personal information and are subject to follow Information Security and Privacy Policies.