Manager

Moder; Bengaluru; Vor Ort; INR 1.200.000 - 1.800.000; Vollzeit

Zusammenfassung

Moder, a tech-forward outsourcing firm, seeks a seasoned Third Party Risk Manager to drive risk reviews for vendor relationships supporting US financial clients. You will assess financial stability, information security, and regulatory compliance while partnering with Legal, Compliance, and IT teams.

You will prepare audit-ready summaries, engage stakeholders, and escalate gaps as needed. Night shifts and WFO operations apply.

Qualifikationen

• Strong knowledge of third party risk management lifecycle activities.
• Understanding of regulatory expectations for third party risk management.
• Familiarity with OCC Bulletin 2023-17 risk management guidance.
• Ability to assess third party risk across multiple domains including information security and privacy.
• Experience reviewing SOC 1/2, ISO certifications, penetration testing summaries, and regulatory materials.
• Strong analytical skills with ability to interpret complex documentation and document risks.
• Excellent written communication for audit-ready narratives and reports.
• Stakeholder management across business units, procurement, legal, compliance, and IT.
• Ability to manage multiple reviews simultaneously and meet SLAs.
• Proficiency with Process Unity as the master vendor repository.

Aufgaben

• Conduct risk-based third party due diligence reviews for vendor relationships based on risk, criticality, data sensitivity, and regulatory impact.
• Review and assess third party documentation (financial statements, SOC reports, BCDR plans, information security questionnaires, licenses, attestations).
• Evaluate controls related to information security, cybersecurity, privacy, continuity, regulatory compliance, and consumer protection.
• Document gaps, weaknesses, residual risks, and exceptions with escalation.
• Collaborate with SMEs to obtain clarifications and determinations on remediation.
• Prepare audit-ready summaries, risk assessments, and management-ready packages for stakeholders.

Kenntnisse

Third party risk management lifecycle

Regulatory risk management

OCC 2023-17 guidance

Multi-domain risk assessment

SOC 1/2, ISO certifications review

Analytical thinking

Written communication

Stakeholder management

Multiple due diligence reviews

Judgment and risk escalation

Process Unity

Tools

Process Unity

Jobbeschreibung

Moder formerly known as Archwell Operations is a part of Archwell Holdings founded in 2017. We are a tech forward outsourcing company specializing in supporting the US Mortgage, Insurance, and Banking industries. We specialize in end-to-end component-based outsourcing, managing one-off projects to becoming an extension of the customer service or operations team. Our team is built on industry expertise and provides the traction clients need to grow their company.

Equipped with diverse tools, platforms, solutions, and services we strive to work towards our mission to positively impact the financial health of companies by powering in-house processes using top talent, workflow best practices, and progressive technology.

Link - https://www.gomoder.com/about-moder

Skill-Third Party Risk Management/Vendor Risk Management

Third Party Due Diligence Review Skills – Financial Institution

Role Overview: Responsible for conducting risk-based third party due diligence reviews to evaluate vendor financial stability, operational resilience, information security, compliance posture, regulatory risk, and overall suitability to support the institution’s business objectives. The role requires strong risk judgment, documentation discipline, and the ability to partner with business owners, subject matter experts, Legal, Compliance, Information Security, Procurement, and senior management.

Core Responsibilities

• Conduct initial and periodic due diligence reviews for third party relationships based on inherent risk, criticality, service type, data sensitivity, and regulatory impact.
• Review and assess third party documentation, including financial statements, SOC reports, business continuity and disaster recovery plans, information security questionnaires, insurance certificates, compliance attestations, licenses, certifications, and policy evidence.
• Evaluate third party controls related to information security, cybersecurity, privacy, business continuity, operational resilience, financial health, subcontractor oversight, regulatory compliance, and consumer protection obligations.
• Identify, document, and escalate due diligence gaps, control weaknesses, residual risks, and exceptions in accordance with the institution’s third party risk management framework.
• Collaborate with business owners and subject matter experts to obtain clarifications, assess compensating controls, and determine whether remediation or enhanced monitoring is required.
• Prepare clear, audit-ready due diligence summaries, risk assessments, recommendations, and approval packages for stakeholders, governance committees, and senior leadership.
• Support contract review by identifying risk-related requirements, including service level expectations, audit rights, data protection provisions, regulatory access, termination rights, business continuity obligations, and subcontractor controls.
• Maintain accurate records in the third party risk management system, including review outcomes, risk ratings, issues, approvals, and ongoing monitoring requirements.

Required Skills and Qualifications

• Strong knowledge of third party risk management lifecycle activities, including planning, due diligence, third party selection, contracting, ongoing monitoring, issue management, and termination.
• Understanding of financial institution regulatory expectations for third party risk management, including risk-based oversight, safe and sound operations, consumer protection, data security, and operational resilience.
• Familiarity with OCC Bulletin 2023-17 Interagency Guidance on Third-Party Relationships: Risk Management, including its risk-based expectations for due diligence, contract negotiation, ongoing monitoring, governance, and third party relationship life cycle management.
• Ability to assess third party risk across multiple domains, including operational risk, compliance risk, information security risk, privacy risk, financial risk, reputational risk, concentration risk, and strategic risk. (using internal SMEs for certain domains in bold)
• Experience reviewing SOC 1, SOC 2, ISO certifications, penetration testing summaries, vulnerability management evidence, business continuity documentation, financial statements, insurance coverage, and regulatory compliance materials.
• Strong analytical skills with the ability to interpret complex documentation, identify control gaps, determine risk significance, and recommend practical mitigation actions.
• Excellent written communication skills with the ability to produce concise, professional, audit-ready due diligence narratives, risk rationales, executive summaries, and issue documentation using established templates based on vendor risk tier.
• Strong stakeholder management skills, including the ability to engage business owners, vendors, procurement, legal, compliance, information security, privacy, and operational risk teams.
• Ability to manage multiple due diligence reviews simultaneously while meeting service level expectations and maintaining quality, consistency, and documentation standards.
• Sound judgment and decision-making skills, with the ability to elevate material risks, challenge incomplete responses, and support risk-based approval decisions.
• Proficiency with Process Unity- the master vendor repository that all due diligence assessments are conducted in.

Preferred Experience

• Prior experience in third party risk management, vendor risk management, operational risk, compliance, audit, procurement risk, or information security within a bank, mortgage servicer, credit union, fintech, or other regulated financial institution.
• Familiarity with regulatory guidance and industry frameworks related to third party risk, cybersecurity, privacy, business continuity, and operational resilience.
• Experience supporting governance forums, audit requests, regulatory examinations, management reporting, issue remediation, and policy or procedure enhancement.
• Professional certifications such as CTPRP, CTPRA, CRVPM, CISA, CRISC, CISSP, CAMS, CRCM, or other risk, compliance, audit
• Risk-based thinking and professional skepticism
• Regulatory awareness and control discipline
• Attention to detail and documentation accuracy
• Executive-level written and verbal communication
• Issue identification, escalation, and remediation trackingCross-functional collaboration and vendor engagement
• Prioritization, time management, and SLA adherence
• Continuous improvement mindset and process standardization
• US Mortgage, Consumer Lending, Loans , Home Loan

The above mentioned role involve WFO and Night Shifts