ESSENTIAL FUNCTIONS:
End-to-End Onboarding & Due Diligence
- Inherent Risk Assessment: Work with Business Line Owners to evaluate each proposed vendor relationship and assign the appropriate inherent risk tier.
- Rigorous Document Analysis: Collect, review, and challenge third-party control documentation, including SOC 1 and SOC 2 Type II reports, audited financials, and business continuity plans.
- Contract Safeguards: Work with Legal and Procurement to include required regulatory provisions in vendor contracts, such as audit rights, service-level agreements (SLAs), and data security requirements.
- Secure Offboarding: Coordinate offboarding for terminated relationships, verifying data destruction, system access removal, and final contract closeout.
Periodic Reviews & Continuous Monitoring
- Periodic Reassessments: Maintain the review schedule and conduct formal periodic risk assessments for all third parties in accordance with the Bank's Third-Party Relationship Risk Management Program.
- Financial Viability Monitoring: Evaluate the ongoing financial health of critical third parties using financial statements and credit metrics to identify risks that could disrupt operations.
- Issue and Gap Remediation: Document deficiencies identified during periodic reviews, track corrective actions, and work with vendor contacts to meet remediation deadlines.
- Fourth-Party Risks: Identify and monitor concentration risks where primary vendors rely heavily on critical downstream subcontractors.
- Lead Enterprise Third-Party Disruption Drills: Orchestrate annual, bank wide BCP and Pandemic tabletop exercises centered on critical third-party outages. Collaborate across all business lines to simulate, evaluate, and strengthen the bank's collective resilience during a major vendor crisis
Governance, FDIC Exam Readiness & Reporting
- Regulatory Alignment: Maintain and periodically update the Bank's TPRM framework to reflect current regulatory requirements and the Interagency Guidance on Third- Party Relationships.
- Executive Reporting: Prepare vendor risk summaries, concentration dashboards, and open-issue logs for review by the Board of Directors.
- Exam Liaison: Serve as the principal point of contact for internal auditors and examiners regarding the third-party risk management program.
- Perform other duties as assigned.
REQUIRED SKILLS/ABILITIES:
- Excellent verbal and written communication skills.
- Strong organizational and time-management skills, with close attention to detail and a demonstrated ability to meet deadlines.
- Ability to work independently to achieve goals and objectives.
- Ability to evaluate key contract provisions and propose changes as necessary
- Proficient with Microsoft Office Suite or related software.
- Strong ability to interpret and evaluate information security posture, SOC reports, and financial statements of corporate vendors.
SUPERVISORY RESPONSIBLITY:
- This position does not supervise employees.
EDUCATION and EXPERIENCE:
- High school diploma or equivalent required.
- Bachelor's degree in business or a related field preferred. In lieu of a bachelor's degree, a minimum of (five) 5 years of equivalent experience is required.
- Experience in using and administering a dedicated vendor management platform is preferred.
- Knowledge of the Interagency Guidance on Third-Party Relationships, FFIEC IT examination handbooks, and GLBA data privacy expectations preferred.
- Professional Certifications: CTPRP, CISA, CRISC, or a comparable professional certification is preferred.
PHYSICAL REQUIREMENTS:
- Ability to maintain concentration and mental alertness are needed to perform the position's responsibilities.
- Ability to lift to and move up to 25 pounds.
- Ability to communicate effectively with customers and staff in person, by email, and by telephone.
- Ability to sit or stand for extended periods.
- The position may require close vision and the ability to adjust focus.
- Reasonable accommodation may be made to enable individuals with disabilities to perform the essential functions