Senior Risk Analyst; Data Risk

Overview

Navy Federal Credit Union currently does not provide sponsorship for this role. Applicants must be authorized to work in the United States without the need for current or future sponsorship.

This senior individual-contributor role sits in the First Line of Defense and translates enterprise risk, data governance, technology, information security, privacy, and records management requirements into practical execution for HR. Workstream leadership, executive reporting, and decision support make up the largest share of the work, alongside risk assessment and governance analysis. You will own assigned work independently and produce management-ready deliverables with limited rework.

Deep expertise across every risk discipline is not expected.

• Lead HR data risk assessments, reviews, and governance activities, and analyze what enterprise policies, standards, and controls mean for HR processes, applications, reporting, analytics, vendors, and technology.
• Assess materiality and recommend proportionate responses grounded in control objectives, business impact, and applicable requirements.
• Evaluate control objectives, evidence, ownership, dependencies, issues, exceptions, and remediation; identify gaps, inconsistencies, emerging risks, and unresolved questions.
• Frame complex issues into clear management decisions with options, tradeoffs, and a recommended path forward - not just a list of problems.
• Escalate material risk decisions, unresolved ownership, exceptions, significant dependencies, and matters requiring formal governance or management acceptance.
• Work spans access and information security; data governance, quality, and reporting; data sharing, lifecycle, and records management; third-party and vendor risk; and analytics, AI, cloud, and emerging technology.

• Independently lead the risk analysis and execution coordination for assigned HR Data Risk projects and work streams.
• Turn ambiguous assignments into clear outcomes, milestones, actions, dependencies, deliverables, and definitions of completion.
• Distinguish governance, oversight, and decision responsibilities from execution owned by business, technology, vendor, or enterprise partners - and surface dependencies rather than absorbing work that belongs elsewhere.
• Coordinate across HR, Technology, Risk, and other enterprise partners; facilitate working sessions, document decisions and actions, and drive follow-up.
• Identify blockers, changing requirements, ownership gaps, and competing priorities, and elevate appropriately.
• Right-size scope where practical minimum requirements still maintain appropriate risk coverage.

• Build polished, visually effective presentations, dashboards, scorecards, and portfolio reporting for management and executive audiences.
• Synthesize complex, fragmented, or incomplete information into clear analysis, recommendations, and decision materials.
• Translate detailed workstream information into concise leadership narratives focused on what changed, why it matters, and what decision or action is required - covering risk posture, key risks and dependencies, operational impact, upcoming milestones, and recommendations.
• Analyze across work streams to surface trends, recurring issues, emerging risks, and capacity or dependency concerns requiring management attention.

• Review risk documentation, presentations, dashboards, and trackers for accuracy, completeness, consistency, and unsupported conclusions before materials advance.
• Build reusable templates, trackers, playbooks, and decision tools, and identify opportunities to automate, standardize, or simplify recurring reporting, tracking, and evidence collection.

• Five or more years of progressively responsible experience in risk management, operational or technology risk, information security risk, data governance, compliance, audit, controls, risk transformation, or a related discipline; or an equivalent combination of education and experience.
• Demonstrated risk and control judgment - applying risk identification, control objectives, evidence, issues, remediation, exceptions, and escalation in practice, not familiarity with the concepts alone.
• Demonstrated experience independently leading complex projects, assessments, work streams, or cross-functional initiatives through to defined outcomes.
• Proven ability to assess materiality, organize ambiguous or incomplete information, and…