You should split your regex into two parts (not two expressions!) To make your life easier:
First, map the format your username should be: ^[a-zA-Z][a-zA-Z0-9]*[._-]?[a-zA-Z0-9]+$
Now we just need to check the length limit. In order not to spoil with the already found pattern, you can use an inappropriate match that checks only the number of characters (this, in turn, is a hack to create and a pattern for your regular expression): (?=^.{3,20}$)
The regular expression will try to match a valid format if the length limit matches. It does not consume, so after its successful completion the engine is still at the beginning of the line.
so, all together:
(?=^.{3,20}$)^[a-zA-Z][a-zA-Z0-9]*[._-]?[a-zA-Z0-9]+$

Demo version of Debuggex
source share