Business Controls Senior Associate - Third Party

Fifth Third; Cincinnati (OH); Hybrid; USD 80,000 - 110,000; Full time

Job summary

Fifth Third Bank in Cincinnati, OH is seeking a Business Controls Senior Associate to lead third-party risk and ERM-related activities. You will perform due diligence, review SOC 1/2 and ISO reports, and support risk assessments, contract governance, and issue remediation with cross-functional partners.

You will travel domestically and internationally as needed, collaborate with Legal, Compliance, Information Security and Internal Audit, and help enhance controls, policies, and monitoring using

Qualifications

• Bachelor’s degree or equivalent experience required; Master’s degree preferred.
• Certifications such as CISA or CRISC are preferred.
• 5+ years of financial services risk, business controls or compliance experience.

Responsibilities

• Assist with development and implementation of controls, policies, and risk mitigation strategies.
• Conduct third-party risk assessments, onsite assessments, and contract reviews.
• Review assurance reports (SOC 1/2, ISO 27001) and monitor remediation activities.
• Coordinate risk assessments and governance across multiple stakeholders.

Skills

Risk management

Due diligence

Third-party assessments

SOC reports review

Information security

Education

Bachelor's degree

Master's degree preferred

Tools

Coupa

Archer

Power BI

Job description

## Business Controls Senior Associate - Third PartyApply: Cincinnati, OH: Full time: Posted Today: End Date: October 31, 2026 (30+ days left to apply): R73086**Make banking a Fifth Third better** We connect great people to great opportunities. Are you ready to take the next step? Discover a career in banking at Fifth Third Bank.**GENERAL FUNCTION:**As first line of defense, conducts analysis related to identifying, assessing, mitigating, and managing risks necessary to comply with new or changing laws, regulations, regulatory guidance, and best practices deemed necessary by key stakeholders (such as Third Party Management, Legal, Information Security, Compliance, Enterprise Risk and Audit partners). Supports Business Controls in advancing risk management, structure, processes, and tools in support of the organization’s Enterprise Risk Management (ERM) framework. Transforms data into business intelligence by developing and presenting information and insights to stakeholders. Monitors and manages risks to ensure compliance and validation of program effectiveness with assigned line of business or functional area, and Bancorp initiatives.Responsible and accountable for risk by openly exchanging ideas and opinions, elevating concerns, and personally following policies and procedures as defined. Accountable for always doing the right thing for customers and colleagues and ensures that actions and behaviors drive a positive customer experience. While operating within the Bank’s and LOB’s risk appetites, achieves results by consistently identifying, assessing, managing, monitoring, and reporting risks of all types.**ESSENTIAL DUTIES AND RESPONSIBILITIES:*** Assist Business Controls leadership with the development and implementation of controls, policies, procedures, and risk mitigation strategies.* Provide expertise related to the identification, assessment, monitoring, testing, and reporting of operational, compliance, information security, and third-party risks.* Conduct third-party due diligence activities, including onsite assessments, site visits, assurance reviews, and risk assessments.* Travel domestically and internationally to perform onsite third-party assessments and evaluate compliance with Bank requirements.* Review assurance reports, including SOC 1, SOC 2, ISO SoA, audit reports, and other compliance documentation.* Perform third-party risk assessments to evaluate third-party compliance with internal policies, contractual obligations, regulatory requirements, and industry standards.* Review contracts and security requirements to assess third-party obligations, risks, and control expectations.* Evaluate information security controls, data privacy controls, restricted environments, and secure workflow processes.* Review vulnerability management programs, vulnerability assessments, penetration testing results, and remediation activities.* Support ongoing monitoring activities, periodic reassessments, and third-party lifecycle management processes.* Investigate and assist with root cause analysis for control failures, operational losses, audit findings, and risk events.* Support issue management activities, including remediation tracking, validation of corrective actions, and issue closure.* Identify control breakdowns, process inefficiencies, and risk exposures and recommend corrective actions.* Support internal audits, external audits, regulatory examinations, and compliance reviews.* Monitor and assess compliance with applicable laws, regulations, standards, and industry best practices, including OCC Heightened Standards.* Build and maintain effective relationships with Third-Parties, Business Partners, Legal, Compliance, Enterprise Risk, Information Security, and Internal Audit.* Coordinate risk assessments, control reviews, issue remediation efforts, and governance activities across multiple stakeholders.* Maintain assessment, issue, exception, and risk documentation within Archer, Coupa, Power BI, and other governance tools.* Assist with regulatory change management activities and the implementation of new risk management requirements.* Participate in escalated supplier-related issues and support enterprise risk mitigation efforts.* Support special projects, acquisitions, strategic investments, and other risk management initiatives as required.* Executes on ERM Scenario Analysis risk management program.* Develop and manage product inventory and execute on ERM product risk review program.* May have additional responsibilities as assigned by LOB/Function leadership and Risk, including but not limited to: + Assistance with new government programs or special internal projects. + Assistance with new risk programs required by regulatory authorities or ERM. + Assistance with diligence, closing, and other matters relating to acquisitions and strategic investments.**MINIMUM KNOWLEDGE AND SKILLS REQUIRED:*** Bachelor’s degree or equivalent experience required (related field preferred).* Master’s degree in relevant field preferred.* Recognized industry certifications such as Certified Information Systems Auditor (CISA), Certified in Risk and Information Systems Control (CRISC), or equivalent is required.* 5 + years of financial services industry, risk, business controls or compliance experience preferred.* Experience performing due diligence activities, including: Third Party Onsite assessments, Assurance report reviews (SOC 1, SOC 2, ISO 27001 etc.), Risk assessments, Vulnerability Management Analysis and Assessments.* Understanding of IT systems, infrastructure, cybersecurity risk and data privacy principles.* Contract & Governance: Contract reviews, Security requirements reviews, Exception management and Issue management.* Travel Requirements: Ability and willingness to travel as needed to conduct onsite third-party assessments, due diligence reviews, and relationship management activities.* Professional verbal and written communication skills and the ability to communicate with discretion and understanding when confidentiality is needed.* Must be analytical and possess ability to interpret and apply policies and regulations across a complex business.* Must proactively identify opportunities and take action to build trusting strategic internal and external relationships and networks.* Must be approachable, collaborative, and have the ability to influence others through interpersonal skills, thrive in a fast-paced dynamic environment, and be comfortable quickly shifting priorities on short notice.* Working knowledge of Microsoft Office products required.* Experience with tools such as Coupa, Archer, and Power BI is preferred* Ability to work with minimal supervision.* For Investment Advisors: FINRA Series 7 and 63/66 licenses preferred. Knowledge of the Securities industry and SEC / FINRA regulations is preferred.