Manager Risk Management

Moder; Bengaluru; On-site; INR 1,200,000 - 2,200,000; Full time

Job summary

Moder in Bengaluru is seeking a risk-focused professional to conduct third-party due diligence reviews for critical relationships. You will assess vendor financial stability, information security, compliance posture, and regulatory risk to support business objectives.

Collaborate with Legal, Compliance, Information Security, Procurement and business owners to document findings, propose mitigations, and assist in contract negotiations.

Qualifications

• Strong knowledge of third party risk management lifecycle activities.
• Understanding of regulatory expectations for third party risk management.
• Familiarity with OCC Bulletin 2023-17 Guidance on Third-Party Relationships.
• Ability to assess risk across domains including information security, privacy, and operational risk.
• Experience reviewing SOC 1, SOC 2, ISO certifications and related materials.
• Analytical skills to interpret documents, identify gaps, and suggest mitigations.
• Excellent written communication for audit-ready narratives and executive summaries.
• Stakeholder management with business owners, vendors, procurement, legal, and compliance.
• Ability to handle multiple reviews with SLA discipline.
• Judgment to elevate material risks and support remediation decisions.
• Proficiency with Process Unity as the master vendor repository.

Responsibilities

• Conduct initial and periodic due diligence reviews for third party relationships based on risk, criticality, service type, data sensitivity, and regulatory impact.
• Review and assess third party documentation including financial statements, SOC reports, BCM/DR plans, information security questionnaires, insurance certificates, attestations, licenses, and policy evidence.
• Evaluate third party controls related to information security, cybersecurity, privacy, BCP, operational resilience, financial health, subcontractor oversight, regulatory compliance, and consumer protection obligations.
• Identify, document, and elevate due diligence gaps, control weaknesses, residual risks, and exceptions in line with risk management framework.
• Collaborate with business owners and SMEs to obtain clarifications, assess compensating controls, and determine remediation or enhanced monitoring.
• Prepare audit-ready due diligence summaries, risk assessments, recommendations, and approval packages for stakeholders and senior leadership.
• Support contract review by identifying risk-related requirements including SLAs, audit rights, data protection provisions, regulatory access, and termination rights.
• Maintain accurate records in the third party risk management system including outcomes, risk ratings, issues, approvals, and monitoring requirements.

Skills

Third party risk management

Risk assessment

Stakeholder management

Analytical thinking

Audit-ready documentation

Regulatory knowledge

Policy interpretation

Communication skills

Vendor engagement

Decision making

Tools

Process Unity

Job description

Role Overview: Responsible for conducting risk-based third party due diligence reviews to evaluate vendor financial stability, operational resilience, information security, compliance posture, regulatory risk, and overall suitability to support the institution’s business objectives. The role requires strong risk judgment, documentation discipline, and the ability to partner with business owners, subject matter experts, Legal, Compliance, Information Security, Procurement, and senior management.

Core Responsibilities

• Conduct initial and periodic due diligence reviews for third party relationships based on inherent risk, criticality, service type, data sensitivity, and regulatory impact.
• Review and assess third party documentation, including financial statements, SOC reports, business continuity and disaster recovery plans, information security questionnaires, insurance certificates, compliance attestations, licenses, certifications, and policy evidence.
• Evaluate third party controls related to information security, cybersecurity, privacy, business continuity, operational resilience, financial health, subcontractor oversight, regulatory compliance, and consumer protection obligations.
• Identify, document, and elevate due diligence gaps, control weaknesses, residual risks, and exceptions in accordance with the institution’s third party risk management framework.
• Collaborate with business owners and subject matter experts to obtain clarifications, assess compensating controls, and determine whether remediation or enhanced monitoring is required.
• Prepare clear, audit-ready due diligence summaries, risk assessments, recommendations, and approval packages for stakeholders, governance committees, and senior leadership.
• Support contract review by identifying risk-related requirements, including service level expectations, audit rights, data protection provisions, regulatory access, termination rights, business continuity obligations, and subcontractor controls.
• Maintain accurate records in the third party risk management system, including review outcomes, risk ratings, issues, approvals, and ongoing monitoring requirements.

Required Skills and Qualifications

• Strong knowledge of third party risk management lifecycle activities, including planning, due diligence, third party selection, contracting, ongoing monitoring, issue management, and termination.
• Understanding of financial institution regulatory expectations for third party risk management, including risk-based oversight, safe and sound operations, consumer protection, data security, and operational resilience.
• Familiarity with OCC Bulletin 2023-17 Interagency Guidance on Third-Party Relationships: Risk Management, including its risk-based expectations for due diligence, contract negotiation, ongoing monitoring, governance, and third party relationship life cycle management.
• Ability to assess third party risk across multiple domains, including operational risk, compliance risk, information security risk, privacy risk, financial risk, reputational risk, concentration risk, and strategic risk. (using internal SMEs for certain domains in bold)
• Experience reviewing SOC 1, SOC 2, ISO certifications, penetration testing summaries, vulnerability management evidence, business continuity documentation, financial statements, insurance coverage, and regulatory compliance materials.
• Strong analytical skills with the ability to interpret complex documentation, identify control gaps, determine risk significance, and recommend practical mitigation actions.
• Excellent written communication skills with the ability to produce concise, professional, audit-ready due diligence narratives, risk rationales, executive summaries, and issue documentation using established templates based on vendor risk tier.
• Strong stakeholder management skills, including the ability to engage business owners, vendors, procurement, legal, compliance, information security, privacy, and operational risk teams.
• Ability to manage multiple due diligence reviews simultaneously while meeting service level expectations and maintaining quality, consistency, and documentation standards.
• Sound judgment and decision-making skills, with the ability to elevate material risks, challenge incomplete responses, and support risk-based approval decisions.
• Proficiency with Process Unity- the master vendor repository that all due diligence assessments are conducted in.

Preferred Experience

• Prior experience in third party risk management, vendor risk management, operational risk, compliance, audit, procurement risk, or information security within a bank, mortgage servicer, credit union, fintech, or other regulated financial institution.
• Familiarity with regulatory guidance and industry frameworks related to third party risk, cybersecurity, privacy, business continuity, and operational resilience.
• Experience supporting governance forums, audit requests, regulatory examinations, management reporting, issue remediation, and policy or procedure enhancement.
• Professional certifications such as CTPRP, CTPRA, CRVPM, CISA, CRISC, CISSP, CAMS, CRCM, or other risk, compliance, audit
• Risk-based thinking and professional skepticism
• Regulatory awareness and control discipline
• Attention to detail and documentation accuracy
• Executive-level written and verbal communication
• Issue identification, escalation, and remediation tracking
• Cross-functional collaboration and vendor engagement
• Prioritization, time management, and SLA adherence
• Continuous improvement mindset and process standardization