Third Party Risk Sr. Analyst
The Third Party Risk Management team (TPRM) oversees and manages the bank's diverse and growing portfolio of third parties, and partners with business teams to monitor vendor performance and risks associated with those engagements. The primary role of the Third Party Risk Sr. Analyst is to perform due diligence risk assessments of new and existing business and technology third party service providers. The work will include assisting the Third Party Risk Manager with new and ongoing due diligence risk assessments of third parties.
Responsibilities
- Perform complex risk assessments of current and prospective third-party business and technology providers to assess their control structure and alignment to regulatory, federal / state guidelines and bank requirements and partner with internal stakeholders to assess the residual risk the third party presents to the bank.
- Manage timely completion of requests and follow-ups to third parties for appropriate documentation and review and evaluate materials submitted.
- Partner with internal business units and third parties to inventory all services, status, performance and risk assessments.
- Coordinate and manage the due diligence risk assessment of third-party services by internal subject matter experts within the bank. Failure of proper assessments could result in immediate and significant financial, regulatory, legal or reputational loss to the bank.
- Complete a written assessment detailing third party's service inherent risk(s), strengths of risk scores, along with any risk gaps presenting elevated risk to the bank in order to document completion of the risk assessment activities. This requires frequent interaction with all levels of internal leadership, as well as external third parties.
- Report findings through use of formalized reviews, exception reporting, and risk acceptance reporting.
- Oversee and confirm the resolution of any risk gaps identified during the risk assessment process.
- Will have to maintain a very strong knowledge of the many regulatory, investor, and bank subject matter expert requirements to ensure that each third party meets those requirements as applicable. Must be able to competently interpret and apply the requirements independently to mitigate risk to the bank.
- Contribute to various departmental projects related to third party management activities. This could be as a project lead or supportive role to an existing project.
- Perform other duties as assigned
Qualifications
Requires 3+ years' experience in a position in risk management and / or adherence to regulatory requirements (e.g., PCI; HIPPA; or GLBA) related to the financial services or other heavily regulated industryExperience in performing SOC 1 and SOC 2 audit reviews helpful but not required.Experience in remote and on-site vendor audits helpful but not required.Prefer experience in risk, compliance, vendor management or auditExperience with RSA Archer eGRC a plus, but not requiredPast experience in a position requiring multi-tasking in a high activity and fast-paced environment is strongly preferredStrong attention to detail and exceptional organizational skills requiredTeam oriented, flexible, integrity, ethical, professionalism requiredStrong knowledge of various regulatory (CFPB, OCC, Federal Reserve, etc.) investor (Fannie Mae, Freddie Mac, Ginnie Mae) requirements related to third party engagements and oversight.Strong communication skills (written and oral) required, including the ability to effectively advise business teams across the bankAbility to define problems, collect / analyze data, establish facts, draw valid conclusions, prepare reports, prioritize and manage several concurrent initiatives / projects preferred