Senior Third-Party Risk & Controls Associate

Fifth Third Bank; Cincinnati (OH); On-site; USD 90,000 - 120,000; Full time

Job summary

Fifth Third Bank is seeking a Business Controls Senior Associate - Third Party in Cincinnati, OH. The role focuses on identifying, assessing, mitigating, and managing third-party risks to support ERM.

You will translate data into insights for stakeholders and drive program effectiveness across multiple lines of business. The position requires strong analytical skills, travel for onsite reviews, and experience with SOC/ISO audits, risk assessments, and IT/cybersecurity controls.

Qualifications

• Bachelor’s degree or equivalent in a related field.
• Master’s degree preferred.
• Certification such as CISA or CRISC required.
• 5+ years in financial services risk, controls or compliance preferred.
• Experience with third-party due diligence, SOC/ISO reports, risk assessments, and vulnerability management.

Responsibilities

• Assist in developing and implementing risk controls and mitigation strategies.
• Perform third-party due diligence, onsite assessments, and risk evaluations.
• Review SOC 1/2, ISO 27001, and other audit reports for third-party risk.
• Travel domestically to conduct assessments and ensure regulatory compliance.
• Collaborate with Legal, Compliance, IT Security, Procurement and Audit teams.

Skills

Risk assessment

Third party management

Regulatory compliance

Communication skills

Analytical thinking

Education

Bachelor’s degree or equivalent

Master’s degree preferred

CISA

CRISC

Tools

Coupa

Archer

Power BI

Job description

Fifth Third Bank is seeking a Business Controls Senior Associate - Third Party in Cincinnati, OH. The role focuses on identifying, assessing, mitigating, and managing third-party risks to support ERM.

You will translate data into insights for stakeholders and drive program effectiveness across multiple lines of business. The position requires strong analytical skills, travel for onsite reviews, and experience with SOC/ISO audits, risk assessments, and IT/cybersecurity controls.