Role Summary/Purpose:The Operational Risk Management team is part of the 2nd Line of Defense (2LOD) within Synchrony. The Risk Manager for AI, Generative AI, and Agentic AI is responsible for identifying, assessing and monitoring, risks arising from the design, development, deployment, and operation of AI-enabled capabilities. This role partners with the AI Solutions team to embed effective governance, controls, and assurance across the AI lifecycle. The position reports to the VP, Information Technology Oversight.
Essential Responsibilities- Engage the Information Technology organization in reviewing and assessing AI risk management practices and controls for AI/GenAI/Agentic AI solutions, ensuring risks are understood, measured, and managed in alignment with business objectives and risk appetite.
- Risk assessment and control design: Perform or oversee AI risk assessments (use case, model, vendor, and process), documenting inherent/residual risk, control effectiveness, and remediation plans.
- GenAI and LLM risk controls: Recommend guardrails for prompt/response safety, content moderation, jailbreak/prompt injection defenses, RAG data hygiene, retrieval security, and output verification.
- Agentic AI controls: Establish policies and technical controls for tool access, authorization, least privilege, action confirmation, rate limiting, sandboxing, memory management, and Human-in-the-Loop approval for high-impact actions.
- Model risk management: Partner with Model Validation/Analytics teams to define validation expectations (performance, robustness, bias/fairness, explainability, drift) and ensure independent review where required.
- Security and privacy alignment: Coordinate with Security and Privacy teams on data classification, access control, encryption, secrets management, secure SDLC, privacy-by-design for AI solutions.
- Regulatory and policy alignment: Maintain alignment with relevant standards and regulations (as applicable) and ensure internal AI policies and procedures are current and auditable.
- Third-party and vendor risk: Conduct due diligence on AI vendors (foundation models, platforms, data providers) including security posture, data usage terms, IP considerations, and model transparency/documentation.
- Incident response and issue management: Oversee triage, containment, communications, and lessons learned.
- Monitoring and KRIs: Define and track AI risk metrics (e.g., safety events, policy violations, drift, override rates, hallucination indicators, agent action errors) and report insights to governance forums.
- Training and enablement: Deliver risk guidance and training to product and engineering teams; promote responsible AI practices and documentation discipline.
- Audit readiness: Ensure evidence collection, control testing support, and documentation standards to satisfy internal audit, regulators, and customer due diligence inquiries.
- Perform formal assessments of technology risks using common processes within Risk Management, including Targeted Reviews, Concurrent Reviews and Continuous Monitoring
- Monitor risks being accepted by the business and provide an independent assessment of the risk-taking activities
- Attend and represent 2LOD at multiple Technology Strategic planning sessions including but not limited to: Responsible AI Working Group
- Manage risks and issues within the Synchrony's enterprise governance application (eGRC)
- Perform other duties and/or special projects as assigned
- Support 2nd Line of Defense processes such as the Enterprise Risk Assessment (ERA) and Risk and Control Self-Assessment (RCSA) processes
Qualifications/Requirements- Bachelor's degree in Risk Management, Information Systems, Computer Science, Data Science, Engineering, Mathematics/Statistics, Cybersecurity, or a related field (or equivalent practical experience).
- 6+ years in technology risk, model risk management, information security risk, compliance, operational risk, or assurance roles in a regulated bank or financial institution.
- 1+ years supporting AI/ML or data-driven systems (or demonstrably equivalent exposure) in a regulated bank or financial institution.
- Working knowledge of supervised/unsupervised learning, evaluation metrics, overfitting, data leakage, bias/fairness concepts, drift, and monitoring. Understanding of failure modes ((hallucinations, prompt injection, data exfiltration, jailbreaks), RAG architecture basics)
- Familiarity with AI agents that plan and use tools (APIs), including risks introduced by autonomy (goal misalignment, unsafe actions, cascading failures) and control patterns (scoped tools, approvals, sandboxing).
- Demonstrated experience creating risk assessments, control frameworks, KRIs/KPIs, and remediation plans; ability to articulate risk in business terms and quantify impact/likelihood where possible.
- Strong capability to produce clear governance documentation (policies, standards, procedures, risk assessments, controls) and present to senior stakeholders.
- Evidence of ongoing learning in AI risk, security, privacy, and compliance (courses, workshops, internal enablement, or certifications).
- Ability and flexibility to travel for business as required
Desired Characteristics- Familiarity with information security and risk management concepts Proven analytical skills with strong attention to detail and quality control of work product
- Experience in financial services or banking industry with understanding of financial services regulatory environment
- Competencies: Risk-based decision making; stakeholder management; technical literacy in AI/GenAI/Agentic AI; strong writing and policy craftsmanship; facilitation and influence; analytical thinking; incident and issue management; pragmatic control design.
- Experience in IT operations and/or application support
- Experience with data sourcing and reporting processes with ability to design and implement new analytical capabilities
- Experience with Internal Audits and/or Regulatory Exams and preparing materials to respond to external inquiries providing evidence and rationales and reasoning for provided materials
- IT Project management experience
- Proven experience working in an ambiguous environment with proven ability to explain complex concepts and support points of view
- Strong presentation and communication skills (written and oral) with proven experience interacting with all levels of the organization
- Experience writing formal reports to Senior and Executive levels of Management
- Excellent interpersonal skills - ability to foster relationships and create informal networks, both internal and external
- Curiosity with the ability to learn new concepts
Grade/Level: 12The salary range for this position is
110,000.00 - 185,000.00 USD Annual and is eligible for an annual bonus based on individual and company performance.
Actual compensation offered within the posted salary range will be based upon work experience, skill level or knowledge.
Salaries are adjusted according to market in CA, NY Metro and Seattle.
Our Way of Working:We're proud to offer you flexibility. At Synchrony, our way of working allows you to have the option to work from home near one of our Hubs or come into one of our offices. You will be required to commute to your nearest Hub (either virtual or physical) for in-person engagement activities such as regular business or team meetings, training and culture events.
*Field Sales and some Commercial team roles may have varied location requirements based upon partner obligations or preferences.
Eligibility Requirements:- You must be 18 years or older
- You must have a high school diploma or equivalent
- You must be willing to take a drug test, submit to a background investigation and submit fingerprints as part of the onboarding process
- You must be able to satisfy the requirements of Section 19 of the Federal Deposit Insurance Act.
- New hires (Level 4-7) must have 9 months of continuous service with the company before they are eligible to post on other roles. Once this new hire time in position requirement is met, the associate will have a minimum 6 months' time in position before they can post for future non-exempt roles. Employees, level 8 or greater, must have at least 18 months' time in position before they can post. All internal employees must consistently meet performance expectations and have approval from your manager to post (or the approval of your manager and HR if you don't meet the time in position or performance expectations).
Job Family Group:Risk Management
