TPRM Manager

Skill-Third Party Risk Management

Third Party Due Diligence Review Skills Financial Institution

Position-Manager

Years of experience-7-13 yrs

Notice Period-30-60 days

Role Overview: Responsible for conducting risk-based third party due diligence reviews to evaluate vendor financial stability, operational resilience, information security, compliance posture, regulatory risk, and overall suitability to support the institution’s business objectives. The role requires strong risk judgment, documentation discipline, and the ability to partner with business owners, subject matter experts, Legal, Compliance, Information Security, Procurement, and senior management.

Core Responsibilities

• Conduct initial and periodic due diligence reviews for third party relationships based on inherent risk, criticality, service type, data sensitivity, and regulatory impact.
• Review and assess third party documentation, including financial statements, SOC reports, business continuity and disaster recovery plans, information security questionnaires, insurance certificates, compliance attestations, licenses, certifications, and policy evidence.
• Evaluate third party controls related to information security, cybersecurity, privacy, business continuity, operational resilience, financial health, subcontractor oversight, regulatory compliance, and consumer protection obligations.
• Identify, document, and escalate due diligence gaps, control weaknesses, residual risks, and exceptions in accordance with the institution’s third party risk management framework.
• Collaborate with business owners and subject matter experts to obtain clarifications, assess compensating controls, and determine whether remediation or enhanced monitoring is required.
• Prepare clear, audit-ready due diligence summaries, risk assessments, recommendations, and approval packages for stakeholders, governance committees, and senior leadership.
• Support contract review by identifying risk-related requirements, including service level expectations, audit rights, data protection provisions, regulatory access, termination rights, business continuity obligations, and subcontractor controls.
• Maintain accurate records in the third party risk management system, including review outcomes, risk ratings, issues, approvals, and ongoing monitoring requirements.

Required Skills and Qualifications

• Strong knowledge of third party risk management lifecycle activities, including planning, due diligence, third party selection, contracting, ongoing monitoring, issue management, and termination.
• Understanding of financial institution regulatory expectations for third party risk management, including risk-based oversight, safe and sound operations, consumer protection, data security, and operational resilience.
• Familiarity with OCC Bulletin 2023-17 Interagency Guidance on Third-Party Relationships: Risk Management, including its risk-based expectations for due diligence, contract negotiation, ongoing monitoring, governance, and third party relationship life cycle management.
• Ability to assess third party risk across multiple domains, including operational risk, compliance risk, information security risk, privacy risk, financial risk, reputational risk, concentration risk, and strategic risk. (using internal SMEs for certain domains in bold)
• Experience reviewing SOC 1, SOC 2, ISO certifications, penetration testing summaries, vulnerability management evidence, business continuity documentation, financial statements, insurance coverage, and regulatory compliance materials.
• Strong analytical skills with the ability to interpret complex documentation, identify control gaps, determine risk significance, and recommend practical mitigation actions.
• Excellent written communication skills with the ability to produce concise, professional, audit-ready due diligence narratives, risk rationales, executive summaries, and issue documentation using established templates based on vendor risk tier.
• Strong stakeholder management skills, including the ability to engage business owners, vendors, procurement, legal, compliance, information security, privacy, and operational risk teams.
• Ability to manage multiple due diligence reviews simultaneously while meeting service level expectations and maintaining quality, consistency, and documentation standards.
• Sound judgment and decision-making skills, with the ability to escalate material risks, challenge incomplete responses, and support risk-based approval decisions.
• Proficiency with Process Unity- the master vendor repository that all due diligence assessments are conducted in.

Preferred Experience

• Prior experience in third party risk management, vendor risk management, operational risk, compliance, audit, procurement risk, or information security within a bank, mortgage servicer, credit union, fintech, or other regulated financial institution.
• Familiarity with regulatory guidance and industry frameworks related to third party risk, cybersecurity, privacy, business continuity, and operational resilience.
• Experience supporting governance forums, audit requests, regulatory examinations, management reporting, issue remediation, and policy or procedure enhancement.
• Professional certifications such as CTPRP, CTPRA, CRVPM, CISA, CRISC, CISSP, CAMS, CRCM, or other risk, compliance, audit

Key Competencies

• Risk-based thinking and professional skepticism
• Regulatory awareness and control discipline
• Attention to detail and documentation accuracy
• Executive-level written and verbal communication
• Issue identification, escalation, and remediation tracking
• Cross-functional collaboration and vendor engagement
• Prioritization, time management, and SLA adherence
• Continuous improvement mindset and process standardization