Technology Risk OfficerThe Technology Risk Officer - Cyber / AI provides 2LoD input and effective challenge of Cybersecurity strategic projects with an initial focus on the Cyber response to AI Frontier models Program. For that program the role will be responsible for managing the Controls efforts on a daily basis including working with the other Leaders to ensure that not only are the Controls keeping pace, but also that risks in other aspects of the Program are correctly identified, prioritized and addressed. The role will also coordinate with the other areas of Risk and Compliance to ensure appropriate information flow and input as required by the deliverables, e.g. coordination with BC on Enterprise Resiliency; transforming the Off Network Backup program in alignment with the Cyber response to AI Frontier models Program strategies. Longer term the role will retain responsibility for the enhancements of Cybersecurity to keep pace with the changing landscape of risks to our technology, particularly Cyber security risks related to AI advancements and other emerging technologies; e.g. Quantum.
Key Responsibilities and Duties- Lead the delivery of the Cyber Risk Management Framework, driving the development, maintenance, and rollout of updates to the Cybersecurity policies, standards, and risk-tiering methodology for approval, and ensuring integration with enterprise risk management, and compliance partners
- Monitor changes in the technology landscape to make recommendations on changes to the Risk Framework and follow up with Control Partners to ensure that the controls are efficient and effective to manage the evolving risks
- Manage the 2nd line oversight of the Cyber response to AI Frontier models Program, including risk assessment, control development, prioritization based on risk and reporting on progress including any need to escalate delays or other impediments to successful completion of the program.
- Partner across the Risk and Compliance to ensure that appropriate touch points are in synch and appropriately aligned
- Lead the expansion of Cyber KRIs and KCIs, with a focus on the impacts of expanded AI capabilities, not only to support TIAA's ability to defend itself, but also to monitor the growing threats from the availability of AI to malicious actors, and the ability for internally used AI Agents to go rouge and cause damage from within the firm.
- Coordinate with the evolution of the Technology Risk architecture and Infrastructure to ensure a more secure at baseline and improved testing capabilities not only for functionality, but resiliency and security.
- Manage escalations and cross-functional collaboration across business, technology, legal, compliance, cybersecurity, and audit, resolving issues identified through activities with the Cybersecurity strategic programs.
Educational Requirements- University (Degree) Preferred
Work Experience- 5+ Years Required; 7+ Years Preferred
Physical Requirements- Physical Requirements: Sedentary Work
Career Level 9IC
Required Skills- 5+ years of experience in Cybersecurity, IT Risk Management, IT Audit, and/or IT Compliance
- 1+ years of experience with AI engineering, development, support or compliance
Preferred Skills- 7+ years of working experience in Cybersecurity
- 2+ years of working experience with AI engineering
- Considerable familiarity with financial services / Insurance cybersecurity-related laws/regulations/control frameworks, and experience with evaluating impacts on cybersecurity risks, controls, policies, and standards.
- Extensive experience independently evaluating/performing risk and control assessments and/or audits, across various technology areas/domains.
- Professional Certifications: CISA, CISSP, CRISC and/or CISM.
Related Skills
Adaptability, Automation, Business Acumen, Business Analysis, Consultative Communication, Continuous Improvement Mindset, Data Analysis, Organizational Savviness, Problem Solving, Risk Reporting, Technology Systems
Anticipated Posting End Date:2026-11-02
Base Pay Range: $153,000/yr - $207,000/yr
Actual base salary may vary based upon, but not limited to, relevant experience, time in role, base salary of internal peers, prior performance, business sector, and geographic location. In addition to base salary, the competitive compensation package may include, depending on the role, participation in an incentive program linked to performance (for example, annual discretionary incentive programs, non-annual sales incentive plans, or other non-annual incentive plans).
