Senior InfoSec Risk Oversight Strategist

U.S. Bank; Irving (TX); On-site; USD 120,000 - 141,000; Full time

Benefits offered by this job

Healthcare (medical, dental, vision)

Life insurance

Disability insurance

401(k) retirement plan

Paid vacation

Job summary

U.S. Bank is seeking an Information Security Risk Oversight Professional to lead independent risk oversight across the enterprise Information Security program.

You will test assumptions, challenge ineffective practices, and translate complex technical issues into clear risk insights for senior leaders. The role requires 8+ years in information security or risk management, a Bachelor's degree, and the ability to operate across governance, risk assessment, controls, and metrics.

Qualifications

• Bachelor's degree or equivalent work experience.
• Typically, more than eight years of applicable experience in information security, technology risk, audit, engineering, architecture, or risk management.
• Demonstrated ability to independently analyze complex technical and risk information, identify what is missing, and reach a well-supported conclusion.
• Experience operating in or with a Second Line of Defense, internal audit, regulatory, security engineering, or security architecture function.

Responsibilities

• Provide independent oversight and credible challenge across multiple Information Security pillars, including governance, risk assessments, security architecture, controls, metrics, and issue management.
• Analyze technical designs, security processes, control environments, risk assessments, and support evidence to identify gaps, weaknesses, systemic concerns, and emerging risks.
• Formulate and clearly articulate independent risk opinions supported by technical analysis, relevant evidence, regulatory expectations, and professional judgment.
• Challenge assumptions, inherited processes, and accepted ways of working when they do not produce effective, efficient, or sustainable risk outcomes.
• Evaluate whether first line activities align with applicable laws, regulations, regulatory guidance, industry standards and frameworks, and internal risk appetite and policy requirements.
• Assess the quality and completeness of first line risk identification, risk acceptance, control design, issue remediation, and management reporting.
• Monitor key risk indicators, security metrics, assessment results, incidents, and issue trends to identify material risk, recurring weaknesses, or areas requiring escalation.
• Escalate material risks, control weaknesses, ineffective practices, or unsupported risk positions through appropriate governance and reporting channels.
• Act as a technically credible risk advisor while maintaining 2LoD independence, objectivity, and appropriate boundaries with first line ownership.
• Engage stakeholders with curiosity and respectful challenge, ask probing questions, and ensure conclusions are based on evidence rather than repetition or unsupported assertion.
• Provide practical recommendations that improve risk outcomes without assuming ownership of first line decisions or execution.
• Contribute to executive-level reporting by translating complex technical issues into concise, defensible statements of risk, impact, trend, and required action.
• Stay current on cybersecurity threats, technology changes, regulatory expectations, and industry practices, and apply that knowledge to oversight priorities and challenges.

Skills

Technical security knowledge

Independent risk analysis

Executive communication

Security governance

Regulatory awareness

Certifications (CISSP/CISA/CRISC/CISM)

Education

Bachelor's degree or equivalent

Job description

U.S. Bank is seeking an Information Security Risk Oversight Professional to lead independent risk oversight across the enterprise Information Security program.

You will test assumptions, challenge ineffective practices, and translate complex technical issues into clear risk insights for senior leaders. The role requires 8+ years in information security or risk management, a Bachelor's degree, and the ability to operate across governance, risk assessment, controls, and metrics.