Third Party Risk Management Specialist

ESSENTIAL FUNCTIONS:

End-to-End Onboarding & Due Diligence

• Inherent Risk Assessment: Work with Business Line Owners to evaluate each proposed vendor relationship and assign the appropriate inherent risk tier.
• Rigorous Document Analysis: Collect, review, and challenge third-party control documentation, including SOC 1 and SOC 2 Type II reports, audited financials, and business continuity plans.
• Contract Safeguards: Work with Legal and Procurement to include required regulatory provisions in vendor contracts, such as audit rights, service-level agreements (SLAs), and data security requirements.
• Secure Offboarding: Coordinate offboarding for terminated relationships, verifying data destruction, system access removal, and final contract closeout.

Periodic Reviews & Continuous Monitoring

• Periodic Reassessments: Maintain the review schedule and conduct formal periodic risk assessments for all third parties in accordance with the Bank's Third-Party Relationship Risk Management Program.
• Financial Viability Monitoring: Evaluate the ongoing financial health of critical third parties using financial statements and credit metrics to identify risks that could disrupt operations.
• Issue and Gap Remediation: Document deficiencies identified during periodic reviews, track corrective actions, and work with vendor contacts to meet remediation deadlines.
• Fourth-Party Risks: Identify and monitor concentration risks where primary vendors rely heavily on critical downstream subcontractors.
• Lead Enterprise Third-Party Disruption Drills: Orchestrate annual, bank wide BCP and Pandemic tabletop exercises centered on critical third-party outages. Collaborate across all business lines to simulate, evaluate, and strengthen the bank's collective resilience during a major vendor crisis

Governance, FDIC Exam Readiness & Reporting

• Regulatory Alignment: Maintain and periodically update the Bank's TPRM framework to reflect current regulatory requirements and the Interagency Guidance on Third- Party Relationships.
• Executive Reporting: Prepare vendor risk summaries, concentration dashboards, and open-issue logs for review by the Board of Directors.
• Exam Liaison: Serve as the principal point of contact for internal auditors and examiners regarding the third-party risk management program.
• Perform other duties as assigned.

REQUIRED SKILLS/ABILITIES:

• Excellent verbal and written communication skills.
• Strong organizational and time-management skills, with close attention to detail and a demonstrated ability to meet deadlines.
• Ability to work independently to achieve goals and objectives.
• Ability to evaluate key contract provisions and propose changes as necessary
• Proficient with Microsoft Office Suite or related software.
• Strong ability to interpret and evaluate information security posture, SOC reports, and financial statements of corporate vendors.

SUPERVISORY RESPONSIBLITY:

• This position does not supervise employees.

EDUCATION and EXPERIENCE:

• High school diploma or equivalent required.
• Bachelor's degree in business or a related field preferred. In lieu of a bachelor's degree, a minimum of (five) 5 years of equivalent experience is required.
• Experience in using and administering a dedicated vendor management platform is preferred.
• Knowledge of the Interagency Guidance on Third-Party Relationships, FFIEC IT examination handbooks, and GLBA data privacy expectations preferred.
• Professional Certifications: CTPRP, CISA, CRISC, or a comparable professional certification is preferred.

PHYSICAL REQUIREMENTS:

• Ability to maintain concentration and mental alertness are needed to perform the position's responsibilities.
• Ability to lift to and move up to 25 pounds.
• Ability to communicate effectively with customers and staff in person, by email, and by telephone.
• Ability to sit or stand for extended periods.
• The position may require close vision and the ability to adjust focus.
• Reasonable accommodation may be made to enable individuals with disabilities to perform the essential functions