Senior Third-Party Risk Management Analyst

The Third-Party Risk Management professional will support the assessment and oversight of Third-Party Risk (TPRM) as a key component of the Bank’s broader Operational Risk Management program. This role is responsible for evaluating third-party relationships, monitoring vendor performance, identifying key risks and controls, and analyzing third-party and operational risk data to ensure alignment with the Bank’s risk appetite and regulatory requirements. The position will work closely with stakeholders across all three lines of defense and support vendor risk assessments, remediation efforts, Risk Control Self-Assessments (RCSAs), operational risk incidents, issues management, control testing, and risk reporting.

Key Responsibilities

• Manage the ongoing third-party risk assessment process, including vendor monitoring, periodic reassessments, documentation, and compliance with operational and regulatory standards.


• Evaluate vendor performance and identify potential third-party risks, control gaps, and areas requiring remediation.


• Partner with internal business units to drive vendor remediation efforts and ensure identified gaps are addressed in a timely manner.


• Develop and track quantitative measures and Key Risk Indicators (KRIs) to monitor third-party risk exposure and identify emerging risk trends.


• Prepare monthly and quarterly third-party risk reporting for Business Units, Management, and the Board, including trends and recommended mitigation strategies.


• Provide guidance and training to business stakeholders on the vendor management/risk assessment platform.


• Partner with the vendor management technology provider to support the timely and efficient completion of vendor risk assessments.


• Review the Third-Party Risk Management Policy and recommend updates based on industry practices and regulatory expectations.


• Provide guidance and training on third-party risk management policies, procedures, and requirements.


• Assist with documenting bank-wide processes and executing Risk Control Self-Assessments (RCSAs).


• Assess inherent and residual risks associated with front-to-back processes across the Bank.


• Track, categorize, and analyze vendor-related operational risk incidents and losses.


• Conduct root-cause analysis and deep dives on significant vendor-related incidents and identify appropriate mitigation strategies.


• Track remediation activities and prepare reporting on outstanding risk issues.


• Monitor and test operational risk controls to evaluate the effectiveness of control design and execution.


• Collaborate across the Bank’s three lines of defense to improve consistency and strengthen the overall risk management framework.

Qualifications & Skills

• Strong knowledge of Third-Party Risk Management (TPRM) practices and frameworks, including:


• Vendor risk assessments


• Vendor monitoring


• Vendor documentation and reporting


• Remediation and issue management


• Knowledge of Operational Risk Management, including:


• Risk Control Self-Assessments (RCSAs)


• Incident management


• Issues management


• Risk and control testing


• Inherent and residual risk assessments


• Experience with vendor risk management / TPRM technology platforms.


• Knowledge of applicable federal and state banking regulations and third-party risk management regulatory guidance.


• Ability to critically evaluate risk, consider relevant business factors, and develop well-supported recommendations.


• Strong analytical, problem-solving, and attention-to-detail skills.


• Ability to effectively communicate and collaborate with stakeholders at all levels of an organization.


• Ability to challenge existing processes and identify opportunities to strengthen risk management practices.


• Understanding of Artificial Intelligence (AI) and Machine Learning (ML) capabilities and associated considerations.


• Proficiency with Microsoft Office.


• Excellent written and verbal communication skills.


• Ability to work independently with limited direct supervision.