Chief Data Risk Officer

Regular or Temporary:

Regular

Language Fluency: English (Required)

Work Shift:

1st shift (United States of America)

Need Help?

If you have a disability and need assistance with the application, you can request a reasonable accommodation. Send an email to Accessibility (accommodation requests only; other inquiries won’t receive a response).

Please review the following

job description

The Chief Data Risk Officer is a senior executive position responsible for building and leading the independent oversight and effective challenge function for Enterprise Data and Artificial Intelligence (AI) management. Oversight activities will cover data management practices spanning across Enterprise Data Office (EDA), Artificial Intelligence, Enterprise Data Operations & Delivery, and Line of Business & Corporate Functions Data offices. Reporting to the Chief Information Risk Officer (CIRO), this role serves as a critical second line of defense function, ensuring effective risk management across all data domains, while supporting the institution’s strategic objectives.

This role will lead and implement Risk oversight for Enterprise Data and AI for Truist, which includes: 1) Establish and manage the enterprise data risk strategy via the creation and deployment of the Truist Data Risk Policies, AI Oversight Policies, Data Framework and Assessment; 2) Serve as the Chief Data and AI Risk Officer with independent oversight and challenge to the Chief Data office and Enterprise AI and Data (AID) team for all risk types where / when present in Enterprise Technology; 3) Provide guidance to senior leaders across the company on critical technology issues for both internal and external stakeholders; 4) Use judgment to upscale significant issues and emerging risks; communicate data domain maturity and residual risk to the Board of Directors; 5) consistently and appropriately apply second line of defense corporate authority for managing Truist’s data and AI risk.

Essential Duties and Responsibilities

Following is a summary of the essential functions for this job. Other duties may be performed, both major and minor, which are not mentioned below. Specific activities may change from time to time.

1. Strategic Leadership
- Develop and maintain the enterprise-wide data risk management framework, incorporating emerging risks related to data and AI. Establish risk appetite statements, key risk indicators, and thresholds for data risk across the organization. Provide independent assessment and challenge of technology initiatives, ensuring alignment with risk appetite and regulatory expectations. Lead the evaluation of strategic technology decisions and their impact on the organization’s data risk profile.

2. CDO Risk Leadership
- Provide independent risk oversight (i.e., second line of defense/LOD2) for Truist Enterprise AI and Data through the effective identification, mitigation, monitoring and reporting of operational, technology, data, and compliance related risks within Enterprise Data. This role includes independently challenging LOD1 self-assessments and proving effective challenges of Enterprise Data function to ensure execution across all applicable risk types remain within our stated risk appetite. Additionally, this role is responsible for integrating and aligning all cybersecurity risk with business unit risk, controls and assessments. Work in conjunction with other Risk Oversight Officers (RCSA, IRM, MRMD etc.) to ensure a common set of requirements in establishing a comprehensive risk management approach & transparent decision making and prioritization of technology activities.

3. Governance and Oversight
- Serve as a non-voting member of the first line-owned Technology, Data and Operations risk committee, a voting member of the CIRO led risk committee and actively participate in the Enterprise and Board Risk Committees (BRC)). This includes (a) reviewing and effectively challenging data and AI risk policies, standards, and procedures, (b) overseeing the assessment and monitoring of critical technology vendors and third-party service providers, and (c) ensuring compliance with regulatory requirements and supervisory guidance related to technology and data risk.

4. Risk Assessments
- Define, communicate, and drive the Enterprise Data and AI Risk Framework and direct the assessment of data management, data privacy, data protection, data resiliency and AI. Provide independent assessment and oversight of the maturity of technology and adequacy of technology controls in meeting agreed to business outcomes for performance, stability, security and service availability. Assessments should leverage agreed upon metrics produced by Business Units (LOD1), but challenge and validated as appropriate.

5. Risk Continuous Monitoring
- Oversee the evaluation of tec