Risk Management Analyst

General Summary:

The primary purpose of this position is to provide independent risk oversight and manage the day-to-day administration and continuous improvement of Centris's Third-Party Risk Management and Business Continuity Management programs. The position identifies, assesses, monitors, and reports risk; provides effective challenge and guidance to business owners and management; and supports appropriate risk mitigation and escalation. The position helps protect credit union assets, strengthen operational resilience, and maintain compliance with applicable regulatory requirements and Centris's risk appetite.

This position works collaboratively with business units, management, third parties, auditors, regulators, and other stakeholders to identify, assess, monitor, and mitigate risk and maintain audit and examination readiness.

Essential Responsibilities:

Organizational Leadership & Member Service

• Promote and model the Centris Vision, Mission, Values and Team Principles.
• Deliver exceptional service to internal and external members in accordance with the Centris Service Promises.
• Build and maintain collaborative relationships with business units, management, third parties, auditors, regulators, and other stakeholders to support Strategic Risk Management goals and deliverables.

Third-Party Risk Management

• Manage the day-to-day administration and ongoing enhancement of the Third-Party Risk Management Program in alignment with Centris risk appetite, policies, and regulatory expectations.
• Provide guidance to management and business owners on third-party governance, risk assessment, due diligence, monitoring, mitigation, and lifecycle management.
• Coordinate and oversee the third-party onboarding, risk assessment, due diligence, monitoring, renewal, and offboarding processes.
• Ensure third-party relationships are appropriately risk rated, documented, approved, monitored, and periodically reassessed based on established risk-rating methodologies.
• Request, review and analyze third-party documentation, including financial statements, SOC and audit reports, information security assessments, business continuity documentation, insurance, and regulatory/compliance information.
• Evaluate identified risks and control deficiencies and work with business owners and management to develop appropriate mitigation strategies, remediation plans, risk acceptance, or escalation as appropriate.
• Monitor third-party contracts, renewals, amendments, material changes, and terminations as they relate to the third-party risk management lifecycle, coordinating with appropriate business, legal, procurement, and other stakeholders.
• Identify and monitor third-party risks related to concentration, provision of critical third-party, subcontractor/fourth-party, and other emerging risks as appropriate.
• Prepare and maintain third-party risk management reporting, metrics, dashboards, and management information to support management and executive oversight.
• Manage and administer third-party risk management technology, including system configuration, data integrity, workflow, reporting, enhancements, and process improvements.
• Maintain third-party risk management policies, procedures, standards, and related documentation and recommend updates as needed.
• Support internal audit, external audit, regulatory examination, and other oversight activities related to third-party risk management.

Business Continuity Management

• Manage the day-to-day administration and continuous improvement of the Business Continuity Management Program.
• Facilitate and coordinate Business Impact Analyses (BIAs), business continuity risk assessments, recovery strategies, and business continuity planning activities
• Work with business owners and Technology Services to identify critical processes, dependencies, recovery requirements, Recovery Time Objectives (RTOs), Recovery Point Objectives (RPOs), and appropriate recovery strategies.
• Coordinate periodic review and maintenance of business continuity plans and related documentation to ensure plans remain current and reflect changes to business processes, personnel, technology, facilities, and third-party relationships.
• Plan, facilitate, document, and coordinate business continuity exercises, tabletop exercises, and other program testing activities.
• Support business continuity activities during significant operational disruptions.
• Maintain business continuity management systems, program documentation, reporting, and organizational awareness materials.
• Develop and provide periodic reporting to management regarding business continuity program status, testing results, significant risks, outstanding corrective actions, and areas requiring management attention.
• Support internal audit, external audit, regulatory examination, and other oversight activities related to business continuity and operational resilience.

Insurance Administration

• Manage the corporate insurance program, including policy renewals, coverage analysis, claim administration, and insurer communications.
• Maintain insurance records and assist in evaluating organizational insurance needs and coverage requirements.

Key Performance Result Areas and Accountabilities:

• Effective administration and continuous improvement of Third-Party Risk Management and Business Continuity programs
• Timely and accurate risk assessments, due diligence, monitoring, testing, and remediation
• Identification and escalation of significant risks and control gaps
• Quality and timeliness of management reporting
• Audit and regulatory examination readiness
• Policy, procedure, and program governance
• Effective relationship management and collaboration
• Attention to detail, accuracy, organization, and follow-through

Primary Position Dimensions:

• Staff supported

Scope: 330+

• Third-party relationships managed

Scope: 500-800

• Third-party assessment/reviews

Scope: 50-70

• Business processes/BIA

Scope: 50-75

• Business continuity exercises/testing

Scope: 5-10/year

• Annual contracts/renewals monitored

Scope: 150-300

Job Requirements:

• Education and Experience Requirement
• Bachelor's degree in Business Administration, Finance, Risk Management, Accounting, Economics, Law, or a related field and/or related work experience.
• Minimum of 3-5 years of experience in risk management, third-party/vendor risk, business continuity, audit, regulatory compliance, or a related field, preferably within a financial institution, preferred.
• Experience managing or administering a risk management program including development of process, procedure, risk assessment, monitoring, and issue remediation preferred.
• Experience reviewing financial statements, SOC reports, contracts, insurance documentation, and risk assessments preferred.
• Experience in business continuity management, BIA, RTO/RPO testing and resiliency strategies.
• Knowledge of NCUA, FFIEC, and applicable regulatory requirements related to third-party risk, business continuity, operational resilience, and financial institution risk management preferred.
• Technical Skills Requirement
• Strong analytical, critical thinking, and risk assessment skills.
• Ability to analyze contracts, audit reports, regulatory guidance, financial information, and technical documentation.
• Experience with Onspring software preferred.
• Proficiency with Microsoft Office applications, including Excel, Word, PowerPoint, and Outlook.
• People Skills Requirement
• Ability to work effectively both independently and collaboratively.
• Strong written, verbal and interpersonal communication skills.
• Ability to communicate risk and recommendations clearly to business owners and management.
• Strong organizational skills with the ability to manage multiple priorities and deadlines.
• Other Requirements
• Ability to exercise sound judgment, make recommendations, and escalate issues with limited direction.
• Must report to work regularly and on time and work the hours necessary to fulfill the responsibilities of the position.
• Must be knowledgeable in BSA and compliance requirements enforced on the credit union by state and federal law as applicable.
• Must be bondable.

Work from home eligible: Hybrid