TPRM Manager

Venpa Staffing; Bengaluru; On-site; INR 2,400,000 - 3,600,000; Full time

Job summary

Venpa Staffing in Bengaluru, India, seeks a seasoned Manager to lead Third Party Risk Management, evaluating vendor financial stability, information security, and regulatory compliance to support business objectives. You will partner with Legal, Compliance, Information Security, Procurement, and senior leadership to document risk assessments and determine remediation or enhanced monitoring as needed.

The role requires strong risk judgment, documentation discipline, and the ability to manage

Qualifications

• Knowledge of TPRM lifecycle activities including planning, due diligence, contracting, monitoring, and termination.
• Familiarity with regulatory expectations for TPRM in financial institutions.
• Experience reviewing SOC 1, SOC 2, ISO certifications, pen testing reports, and compliance materials.
• Ability to assess multiple risk domains: operational, compliance, information security, privacy, financial, and reputational.
• Strong analytical and documentation skills; ability to produce audit-ready narratives and risk rationales.
• Excellent stakeholder management with cross-functional collaboration.

Responsibilities

• Conduct initial and periodic due diligence reviews for third party relationships based on risk, criticality, data sensitivity, and regulatory impact.
• Review and assess third party documentation including financial statements, SOC reports, continuity plans, information security questionnaires, licenses, and attestations.
• Evaluate third party controls across information security, cybersecurity, privacy, resilience, and regulatory compliance.
• Document and elevate gaps, weaknesses, residual risks, and exceptions per risk management framework.
• Collaborate with business owners and SMEs to obtain clarifications and determine remediation or monitoring needs.
• Prepare audit-ready due diligence summaries, risk assessments, recommendations, and approval packages for stakeholders.
• Support contract reviews by identifying risk-related requirements such as audit rights, data protection, termination, and subcontractor controls.
• Maintain accurate records in the third party risk management system including outcomes, risk ratings, and monitoring requirements.

Skills

Third party risk mgmt

Regulatory oversight

Risk assessment

Documentation discipline

Stakeholder management

Multi-domain risk

Written communication

Time management

SLA adherence

Tools

Process Unity

Job description

Skill-Third Party Risk Management

Third Party Due Diligence Review Skills Financial Institution

Position-Manager

Years of experience-7-13 yrs

Notice Period-30-60 days

Role Overview: Responsible for conducting risk-based third party due diligence reviews to evaluate vendor financial stability, operational resilience, information security, compliance posture, regulatory risk, and overall suitability to support the institution’s business objectives. The role requires strong risk judgment, documentation discipline, and the ability to partner with business owners, subject matter experts, Legal, Compliance, Information Security, Procurement, and senior management.

Core Responsibilities

• Conduct initial and periodic due diligence reviews for third party relationships based on inherent risk, criticality, service type, data sensitivity, and regulatory impact.
• Review and assess third party documentation, including financial statements, SOC reports, business continuity and disaster recovery plans, information security questionnaires, insurance certificates, compliance attestations, licenses, certifications, and policy evidence.
• Evaluate third party controls related to information security, cybersecurity, privacy, business continuity, operational resilience, financial health, subcontractor oversight, regulatory compliance, and consumer protection obligations.
• Identify, document, and elevate due diligence gaps, control weaknesses, residual risks, and exceptions in accordance with the institution’s third party risk management framework.
• Collaborate with business owners and subject matter experts to obtain clarifications, assess compensating controls, and determine whether remediation or enhanced monitoring is required.
• Prepare clear, audit-ready due diligence summaries, risk assessments, recommendations, and approval packages for stakeholders, governance committees, and senior leadership.
• Support contract review by identifying risk-related requirements, including service level expectations, audit rights, data protection provisions, regulatory access, termination rights, business continuity obligations, and subcontractor controls.
• Maintain accurate records in the third party risk management system, including review outcomes, risk ratings, issues, approvals, and ongoing monitoring requirements.

Required Skills and Qualifications

• Strong knowledge of third party risk management lifecycle activities, including planning, due diligence, third party selection, contracting, ongoing monitoring, issue management, and termination.
• Understanding of financial institution regulatory expectations for third party risk management, including risk-based oversight, safe and sound operations, consumer protection, data security, and operational resilience.
• Familiarity with OCC Bulletin 2023-17 Interagency Guidance on Third-Party Relationships: Risk Management, including its risk-based expectations for due diligence, contract negotiation, ongoing monitoring, governance, and third party relationship life cycle management.
• Ability to assess third party risk across multiple domains, including operational risk, compliance risk, information security risk, privacy risk, financial risk, reputational risk, concentration risk, and strategic risk. (using internal SMEs for certain domains in bold)
• Experience reviewing SOC 1, SOC 2, ISO certifications, penetration testing summaries, vulnerability management evidence, business continuity documentation, financial statements, insurance coverage, and regulatory compliance materials.
• Strong analytical skills with the ability to interpret complex documentation, identify control gaps, determine risk significance, and recommend practical mitigation actions.
• Excellent written communication skills with the ability to produce concise, professional, audit-ready due diligence narratives, risk rationales, executive summaries, and issue documentation using established templates based on vendor risk tier.
• Strong stakeholder management skills, including the ability to engage business owners, vendors, procurement, legal, compliance, information security, privacy, and operational risk teams.
• Ability to manage multiple due diligence reviews simultaneously while meeting service level expectations and maintaining quality, consistency, and documentation standards.
• Sound judgment and decision-making skills, with the ability to elevate material risks, challenge incomplete responses, and support risk-based approval decisions.
• Proficiency with Process Unity- the master vendor repository that all due diligence assessments are conducted in.

Preferred Experience

• Prior experience in third party risk management, vendor risk management, operational risk, compliance, audit, procurement risk, or information security within a bank, mortgage servicer, credit union, fintech, or other regulated financial institution.
• Familiarity with regulatory guidance and industry frameworks related to third party risk, cybersecurity, privacy, business continuity, and operational resilience.
• Experience supporting governance forums, audit requests, regulatory examinations, management reporting, issue remediation, and policy or procedure enhancement.
• Professional certifications such as CTPRP, CTPRA, CRVPM, CISA, CRISC, CISSP, CAMS, CRCM, or other risk, compliance, audit

Key Competencies

• Risk-based thinking and professional skepticism
• Regulatory awareness and control discipline
• Attention to detail and documentation accuracy
• Executive-level written and verbal communication
• Issue identification, escalation, and remediation tracking
• Cross-functional collaboration and vendor engagement
• Prioritization, time management, and SLA adherence
• Continuous improvement mindset and process standardization