Director- Third Party Risk and Business Continuity

Mountain America Credit Union; Idaho Falls (ID); Hybrid; USD 150,000 - 210,000; Full time

Job summary

Mountain America Credit Union is seeking a Director of Third-Party Risk and Business Continuity to lead the enterprise risk programs, including third-party risk management and operational resilience. This role collaborates with Legal, Procurement, Compliance, IT, and Information Security to ensure risk programs align with strategic objectives and regulatory expectations.

The position reports to the VP of Enterprise and Operational Risk and is based in a hybrid environment with in-office

Qualifications

• Bachelor’s degree in finance, risk management, business administration, economics, or related field.
• 8+ years of experience in enterprise risk, operational risk, business continuity, third-party risk management, contract management, or related risk disciplines.
• Minimum of 3 years leading teams, business processes, or cross-functional initiatives with notable risk and complexity.
• Experience developing or maturing risk, resilience, third-party, or contract management programs in a regulated financial institution.
• Understanding of ERM frameworks, operational resilience expectations, third-party risk lifecycle practices, contract risk considerations, and regulatory expectations for financial institutions.
• Understanding of SOC 2, SSAE-18, financial statements, business impact analysis, recovery planning, operational scenario analysis, and crisis response practices.

Responsibilities

• Lead the design, implementation, testing, and continued maturity of the enterprise business continuity and operational resilience program.
• Partner with IT and Information Security to align planning with technology recovery capabilities and disaster recovery dependencies.
• Coordinate crisis response governance, escalation protocols, and risk reporting for significant events.
• Monitor emerging threats across cyber, supply chain, regulatory, and geopolitical events and maintain related documentation.

Skills

Strategic thinking

Analytical skills

Risk data analysis

Credible challenge

Executive communication

Cross-functional collaboration

GRC platforms

Tableau/Power BI

Education

Bachelor’s degree in finance / risk management

Advanced degree preferred

Tools

Tableau

Power BI

Job description

Job Summary

The Director of Third-Party Risk and Business Continuity is a key leader within Mountain America Credit Union’s Enterprise and Operational Risk function, reporting to the Vice President of Enterprise and Operational Risk. The role is responsible for overseeing the day-to-day execution and continued maturity of the third-party risk management and operational resilience programs, including business continuity, crisis management, operational scenario analysis, and alignment with technology recovery capabilities and disaster recovery dependencies. As part of the second line of defense, the Director partners with business units, Legal, Procurement, Compliance, IT, Information Security, and other stakeholders to align program execution with strategic objectives, regulatory expectations, and enterprise risk standards.

Location

Mountain America Center - Hybrid 9800 S Monroe St Sandy, UT 84070

Schedule

Full Time; this is a hybrid schedule with some weekly in office expectation, based on business need. To be effective, an individual must be able to perform each job duty successfully.

Business Continuity and Operational Resilience

• Lead the design, implementation, testing, and continued maturity of the enterprise business continuity and operational resilience program, including business impact analyses, risk assessments, operational scenario analysis, tabletop exercises, and crisis management simulations.
• Partner with IT and Information Security to align business continuity planning with technology recovery capabilities, disaster recovery dependencies, and business response requirements.
• Coordinate crisis response governance, escalation protocols, decision rights, leadership communications, situational risk reporting, lessons learned, and prioritized remediation for significant operational events.
• Monitor emerging threats and trends, including cyber, technology, supply chain, regulatory, physical security, climate, and geopolitical events; maintain related program documentation, reporting, and remediation visibility for operational continuity risks.

Third-Party Risk and Contract Oversight

• Direct the continued maturity of a scalable third-party risk management program aligned to the credit union’s vendor ecosystem, operational complexity, internal governance standards, and regulatory expectations.
• Oversee the third-party risk lifecycle, including due diligence, risk assessments, contract risk reviews, ongoing monitoring, issue escalation, remediation tracking, exit planning, and senior-level credible challenge of evidence-based risk conclusions.
• Partner with business units, Vendor Relationship Owners, Subject Matter Experts, Legal, Procurement, Information Security, Compliance, and other stakeholders to identify, assess, mitigate, monitor, and document third-party risks, contract provisions, controls, and risk mitigation strategies.
• Monitor third-party performance, control effectiveness, key risk indicators, critical vendor exposure, concentration risk, fourth-party risk, and emerging risk themes, escalating issues when risk exposure exceeds defined thresholds.
• Lead TPRM responses for regulatory exams, internal audits, and independent reviews, including documentation, analysis, issue remediation, and management responses.
• Drive the TPRM program maturity roadmap, including process improvements, automation, data quality, GRC optimization, regulatory alignment, and adoption of sound industry practices.
• Provide executive, committee, and Board-level reporting and recommendations on third-party risk exposure, trends, issues, concentrations, emerging risks, program maturity, remediation priorities, and related governance documentation.

Education and Experience

• Bachelor’s degree in finance, risk management, business administration, economics, or related field required; advanced degree preferred.
• Minimum of 8 years of experience in enterprise risk, operational risk, business continuity, third-party risk management, contract management, or related risk disciplines.
• Minimum of 3 years of experience leading teams, business processes, or cross-functional initiatives with notable risk and complexity.
• Experience developing or maturing risk, resilience, third-party, or contract management programs in a regulated financial institution preferred.
• Understanding of ERM frameworks, operational resilience expectations, third-party risk lifecycle practices, contract risk considerations, and regulatory expectations for financial institutions.
• Understanding of SOC 2, SSAE-18, financial statements, business impact analysis, recovery planning, operational scenario analysis, and crisis response practices.

Preferred certifications

• CTPRP, ORCE, CRCMP, or similar risk-related credentials.

Skills

• Strategic thinking with strong analytical, problem-solving, and risk data interpretation capabilities, including the ability to aggregate, interpret, and visualize complex risk information.
• Demonstrated ability to apply credible challenge, respectfully question assumptions, elevate risks, and influence outcomes using facts, regulatory knowledge, and clear communication.
• Excellent written and verbal communication skills, with the ability to synthesize risk information, prepare executive-ready materials, and collaborate effectively with cross-functional teams, including Compliance, Internal Audit, and senior leadership.
• Familiarity with GRC platforms and risk analytics tools, such as Tableau, Power BI, or similar.

Leadership and Organization Development

• Demonstrates ownership and accountability in delivering high-quality risk governance and reporting outcomes.
• Fosters a culture of collaboration, transparency, and continuous improvement within the Risk function.
• Provides mentorship and guidance to junior team members and peers, supporting professional development and knowledge sharing.
• Aligns team activities and deliverables with operational risk strategy and organizational goals.
• Effectively manages change and adapts to evolving regulatory, strategic, and operational priorities.
• Builds strong cross‑functional relationships to influence outcomes and promote a unified risk culture.
• Contributes to succession planning by developing documentation, tools, and processes that support long‑term team capability and resilience.

Managerial Responsibility

• Has supervisory/managerial responsibilities that are direct or through work leaders or assistants, typically with a subordinate group of 2 to 15 employees.
• Estimates personnel needs and assigns work to meet these needs.
• Supervises, coordinates and reviews the work of assigned staff.
• Recommends candidates for employment, conducts performance evaluations and salary reviews for assigned staff, and applies company policy.

About Us / Company Culture

Mountain America Credit Union is an EEO/AA/ADA/Veterans employer.

Follow @MountainAmericaLife on Facebook and Instagram to see why our team members love working at Mountain America!

Mountain America Credit Union is one of the foremost financial institutions in the country, with more than 95 branches located in 5 states (Utah, Idaho, Nevada, Montana, and Arizona).

We believe that a healthy balance between work, home life, and play is essential to our team members and our success. We offer a friendly, comfortable and inclusive work environment, fun employee activities and exciting charity events to ensure that no day is dull at Mountain America.

Our purpose is to help members enjoy a good life by providing them a positive incentive to save and manage their finances. We also give members easy access to their accounts and allow them to control their funds in a variety of ways, including ATMs, online home banking, mobile banking, direct deposit, automatic payment options and access through a large branch network. When making decisions, we always put members' needs first. It's just the way we do business and a part of the "people helping people" philosophy of credit unions.