Third-Party Risk Management Officer

SmartBank; Brentwood (CA); On-site; USD 110,000 - 180,000; Full time

Job summary

SmartBank is seeking a seasoned Third-Party Risk Management professional to lead the TPRM program across the full vendor lifecycle. You will collaborate with Information Security, Compliance, Legal, Procurement, and Finance to ensure regulated, resilient vendor oversight.

The ideal candidate has 5+ years in vendor risk management with deep understanding of banking regulations and contract risk. The role requires strong governance, executive reporting, and a proactive risk mindset.

Qualifications

• 5+ years in vendor management or third-party risk management, information security, compliance, audit, or banking operations.
• Bachelor's degree preferred in business, finance, risk management, info systems or related.
• Experience with FFIEC, GLBA, OCC, FDIC, Fed guidance, and regulatory exams.

Responsibilities

• Manage the full third-party lifecycle, including planning, risk assessment, due diligence, contract review coordination, monitoring, escalation, offboarding, and termination.
• Perform risk-based due diligence covering SOC reports, financial condition, cybersecurity, privacy, business continuity, insurance, subcontractors, compliance documentation, and unresolved control issues.
• Maintain the third-party inventory, risk tiering, criticality designations, ownership assignments, service descriptions, data access indicators, fourth-party considerations, and risk classifications.
• Coordinate contract and service agreement reviews to identify operational, compliance, security, privacy, business continuity, audit rights, service level, termination, subcontracting, and transition risks.
• Track remediation, document risk acceptances or exceptions, elevate overdue or high-risk issues, validate corrective actions, and drive timely resolution.
• Facilitate risk-based annual and periodic vendor reviews based on policy, regulatory expectations, risk ratings, criticality, performance, control changes, and material relationship changes.
• Monitor concentration risk, fourth-party and subcontractor dependencies, geographic or service-provider exposure, and emerging risks affecting operations, customers, compliance, or resilience.
• Prepare management and board reporting on vendor risk metrics, critical and high-risk providers, due diligence status, overdue reviews, open issues, risk acceptances, emerging risks, concentration risk, exceptions, and program effectiveness.
• Partner with Information Security, Compliance, Legal, Procurement, Finance, Business Continuity, Operational Risk, Internal Audit, and other Business Units to support oversight and reinforce business-owner accountability.
• Maintain accurate, accessible documentation supporting due diligence, risk assessments, monitoring, issue management, risk acceptance, reporting, audits, exams, and regulatory reviews.
• Monitor regulatory guidance and industry practices related to third-party risk management.
• Coordinate annual SOX-related vendor reviews, including SOC report and vendor control assessments impacting financial reporting and key business processes.

Skills

Vendor management

Risk management

Regulatory compliance

Contract review

Executive reporting

Communication skills

Analytical skills

Teamwork

Relationship management

Project management

Integrity

Attention to detail

Education

Bachelor's degree in Business Admin or related

Job description

Looking to join a Great Place to Work Employer and become a valued member of our growing team? At SmartBank, we’re not just offering a job; we’re inviting you to be a part of a culture built on excellence.

Responsible for administering and overseeing the Bank’s Third-Party Risk Management (TPRM) program across the full third-party relationship lifecycle, including planning, due diligence, risk assessment, contract risk review coordination, ongoing monitoring, issue escalation, termination, and board management reporting.

Ensures vendors, service providers, and other third-party relationships are managed consistent with regulatory expectations, contractual obligations, the Bank’s risk appetite, and operational resilience objectives while partnering with business owners, Information Security, Compliance, Legal, Procurement, and other control functions to drive accountability for effective third-party oversight.

Major Duties and Responsibilities:

Core Values & Culture Commitment:

• Uphold SmartBank Core Values and Core Purpose.
• Adheres to and embraces the SmartBank Way by Acting Smart, Looking Smart and Being Smart.

General Responsibilities:

• Manage the full third-party lifecycle, including planning, risk assessment, due diligence, contract review coordination, monitoring, escalation, offboarding, and termination.
• Perform risk-based due diligence covering SOC reports, financial condition, cybersecurity, privacy, business continuity, insurance, subcontractors, compliance documentation, and unresolved control issues.
• Maintain the third-party inventory, risk tiering, criticality designations, ownership assignments, service descriptions, data access indicators, fourth-party considerations, and risk classifications.
• Coordinate contract and service agreement reviews to identify operational, compliance, security, privacy, business continuity, audit rights, service level, termination, subcontracting, and transition risks.
• Track remediation, document risk acceptances or exceptions, elevate overdue or high-risk issues, validate corrective actions, and drive timely resolution.
• Facilitate risk-based annual and periodic vendor reviews based on policy, regulatory expectations, risk ratings, criticality, performance, control changes, and material relationship changes.
• Monitor concentration risk, fourth-party and subcontractor dependencies, geographic or service-provider exposure, and emerging risks affecting operations, customers, compliance, or resilience.
• Prepare management and board reporting on vendor risk metrics, critical and high-risk providers, due diligence status, overdue reviews, open issues, risk acceptances, emerging risks, concentration risk, exceptions, and program effectiveness.
• Partner with Information Security, Compliance, Legal, Procurement, Finance, Business Continuity, Operational Risk, Internal Audit, and other Business Units to support oversight and reinforce business-owner accountability.
• Maintain accurate, accessible documentation supporting due diligence, risk assessments, monitoring, issue management, risk acceptance, reporting, audits, exams, and regulatory reviews.
• Monitor regulatory guidance and industry practices related to third-party risk management.
• Coordinate annual SOX-related vendor reviews, including SOC report and vendor control assessments impacting financial reporting and key business processes.

Position Requirements and Qualifications:

Education:

• Bachelor’s degree in Business Administration, Finance, Accounting, Risk Management, Information Systems, Information Security, or related field preferred.
• Relevant banking, risk management, compliance, or information security experience may be considered in lieu of a degree.
• Minimum of 5+ years of experience in vendor management, third-party risk management, information security, compliance, audit, enterprise risk management, procurement, or banking operations.

Training (licenses, programs, or certificates):

• CRVPM (Certified Regulatory Vendor Program Manager) preferred.
• CTPRP (Certified Third-Party Risk Professional) preferred.
• CRCM, CISA, CRISC, CISSP preferred.

Knowledge, Skills, and Abilities:

• Ability to apply knowledge and sound judgment in decision-making using established guidelines.
• Strong written and oral communication skills.
• Detail oriented and ability to function in a team environment.
• Demonstrates ability to maintain a positive attitude.
• High level of integrity.
• Able to maintain regular and predictable attendance.
• Must possess the ability to handle multiple tasks simultaneously, with frequent interruptions.
• Must be able to able to prioritize and organize daily workflow.
• Strong relationship management and business development/sales skills.
• Thorough knowledge of bank products and services.
• Knowledge of third-party risk management laws, regulations, and supervisory expectations, including interagency guidance, FFIEC guidance, GLBA, privacy, business continuity, and banking regulator expectations.
• Strong analytical, organizational, communication, relationship management, issue management, documentation, project management, and executive reporting skills, with the ability to constructively challenge and elevate risk issues.
• Working knowledge of FFIEC, GLBA, OCC, FDIC, Federal Reserve, and interagency third-party risk management guidance.
• Experience reviewing contracts, SOC reports, risk assessments, business continuity documentation, and regulatory compliance materials.
• Experience preparing executive and board-level reporting.
• Experience supporting regulatory examinations and audits.
• Extensive experience with Examiner interactions.

Work Conditions:

• Able to routinely stand, sit, bend and stoop.
• Frequently and regularly required movements using wrists, hands, and/or fingers.
• Average, ordinary, visual acuity necessary to prepare and inspect documents or products and operate machinery.
• Ability to hear average or normal conversations and receive ordinary information.
• May be required to travel to training sessions or meetings.