Risk Assessment Lead - Cybersecurity Risk Oversight

Risk Assessment Lead

At U.S. Bank, we're on a journey to do our best. Helping the customers and businesses we serve to make better and smarter financial decisions and enabling the communities we support to grow and succeed. We believe it takes all of us to bring our shared ambition to life, and each person is unique in their potential. A career with U.S. Bank gives you a wide, ever-growing range of opportunities to discover what makes you thrive at every stage of your career. Try new things, learn new skills and discover what you excel atall from Day One.

The Risk Assessment Lead serves as a key member of the Cybersecurity Risk Oversight team within the Second Line of Defense (2LoD). This role is accountable for independently assessing and challenging First Line Technology and Information Security practices to ensure effective risk management and regulatory compliance.

This position requires a senior professional who can operate with a high degree of autonomy, prioritize work based on material risk, and influence outcomes through strong technical expertise and stakeholder engagement.

Key Responsibilities:

• Provide independent oversight and credible challenge across Technology and Information Security domains including governance, controls, risk assessments, metrics, and issue management.
• Perform risk-based assessments to identify control gaps, thematic risks, and emerging threats.
• Develop independent risk opinions supported by analysis, evidence, and professional judgment.
• Evaluate alignment with applicable laws, regulations, and industry frameworks (e.g., NIST, FFIEC, PCI).

Risk Management & Framework Execution

• Partner with business and risk stakeholders to support the implementation and maintenance of effective risk management frameworks.
• Identify gaps in processes, systems, controls and drive solutions to minimize risk exposure.
• Ensure risks are actively identified, monitored, escalated, and remediated as appropriate.
• Influence policies and procedures to strengthen the control environment and reduce regulatory risk.

Stakeholder Engagement & Communication

• Build and maintain strong relationships with First Line stakeholders while maintaining independence and objectivity.
• Provide clear, concise, and executive-ready communication of risk posture, key issues, and trends.
• Engage senior leadership to support risk-informed decision making.
• Translate complex technical risks into actionable business insights.

Leadership & Organizational Impact

• Lead, coach, or mentor risk and security professionals; support talent development and team capability.
• Contribute to strategic initiatives impacting enterprise technology, security and risk programs.
• Act as a subject matter expert on technology and cybersecurity risk and regulatory expectations.
• Promote a strong risk culture emphasizing accountability, transparency, and continuous improvement.

Basic Qualifications: Bachelor's degree, or equivalent work experience. Typically more than 10 years of applicable experience.

Preferred Skills/Experience:

• Advanced knowledge of information security domains (e.g., identity and access management, application security, cloud security, vulnerability management, incident response)
• Strong understanding of regulatory requirements and industry standards (e.g., NIST, FFIEC, PCI, and risk management frameworks)
• Experience performing risk assessments, control evaluations, and oversight activities
• Advanced understanding of business operations, systems, and associated risks and controls
• Ability to operate independently with strong judgment and professional skepticism
• Strong analytical, problem-solving, and decision-making skills
• Excellent written and verbal communication skills, including executive-level messaging
• Proven ability to influence stakeholders and challenge effectively without direct authority
• Strong leadership and management skills across people, processes, and projects
• Experience operating within Second Line of Defense, audit, or regulatory environments
• Relevant certifications (e.g., CISSP, CISA, CRISC, CISM) preferred
• Advanced knowledge of regulatory environment and trends in financial services

This role requires working from a U.S. Bank location three (3) or more days per week.

If there's anything we can do to accommodate a disability during any portion of the application or hiring process, please refer to our disability accommodations for applicants.

Benefits:

• Healthcare (medical, dental, vision)
• Basic term and optional term life insurance
• Short-term and long-term disability
• Pregnancy disability and parental leave
• 401(k) and employer-funded retirement plan
• Paid vacation (from two to five weeks depending on salary grade and tenure)
• Up to 11 paid holiday opportunities
• Adoption assistance
• Sick and Safe Leave accruals of one hour for every 30 worked, up to 80 hours per calendar year unless otherwise provided by law

U.S. Bank is an equal opportunity employer. We consider all qualified applicants without regard to race, religion, color, sex, national origin, age, sexual orientation, gender identity, disability or veteran status, and other factors protected under applicable law.

The salary range reflects figures based on the primary location, which is listed first. The actual range for the role may differ based on the location of the role. In addition to salary, U.S. Bank offers a comprehensive benefits package, including incentive and recognition programs, equity stock purchase 401(k) contribution and pension (all benefits are subject to eligibility requirements). Pay Range: $133,365.00 - $156,900.00

U.S. Bank will consider qualified applicants with arrest or conviction records for employment. U.S. Bank conducts background checks consistent with applicable local laws, including the Los Angeles County Fair Chance Ordinance and the California Fair Chance Act as well as the San Francisco Fair Chance Ordinance. U.S. Bank is subject to, and conducts background checks consistent with the requirements of Section 19 of the Federal Deposit Insurance Act (FDIA). In addition, certain positions may also be subject to the requirements of FINRA, NMLS registration, Reg Z, Reg G, OFAC, the NFA, the FCPA, the Bank Secrecy Act, the SAFE Act, and/or federal guidelines applicable to an agreement, such as those related to ethics, safety, or operational procedures.

Applicants must be able to comply with U.S. Bank policies and procedures including the Code of Ethics and Business Conduct and related workplace conduct and safety policies.

Posting may be closed earlier due to high volume of applicants.