Third Party Risk Management Specialist

1st Summit; Johnstown, Northern (Cambria County, KY); Hybrid; USD 90,000 - 140,000; Full time

Job summary

1st Summit in Johnstown, PA seeks a Vendor Risk Manager to evaluate vendor relationships, review SOC reports, and embed regulatory safeguards into contracts. The role requires coordinating offboarding, continuous monitoring, and disruption drills to ensure resilience.

The ideal candidate will analyze financials, assess third-party risk, and report to leadership while coordinating across Legal, Procurement, and IT teams.

Qualifications

• Excellent verbal and written communication skills.
• Strong organizational skills and ability to meet deadlines.
• Ability to work independently to achieve goals and objectives.
• Ability to evaluate key contract provisions and propose changes as necessary.
• Proficient with Microsoft Office Suite or related software.
• Strong ability to interpret and evaluate information security posture, SOC reports, and financial statements of corporate vendors.

Responsibilities

• Inherent Risk Assessment: Work with Business Line Owners to evaluate each proposed vendor relationship and assign the appropriate inherent risk tier.
• Rigorous Document Analysis: Collect, review, and challenge third-party control documentation, including SOC 1 and SOC 2 Type II reports, audited financials, and business continuity plans.
• Contract Safeguards: Work with Legal and Procurement to include required regulatory provisions in vendor contracts, such as audit rights, SLAs, and data security requirements.
• Secure Offboarding: Coordinate offboarding for terminated relationships, verifying data destruction, system access removal, and final contract closeout.
• Periodic Reviews & Continuous Monitoring: Maintain review schedule, conduct formal risk assessments, review financial health of critical third parties.
• Fourth-Party Risks: Identify concentration risks where primary vendors rely on critical downstream subcontractors.
• Lead Enterprise Third-Party Disruption Drills: Orchestrate annual bank-wide BCP and tabletop exercises.

Skills

Communication

Organization

Independence

Contract provisions

MS Office

SOC reports

Education

Bachelor’s degree preferred

5 years equivalent experience

Vendor management platform experience

Tools

Microsoft Office Suite

Job description

CTC Building
137 Allenbill Dr
Johnstown, PA 15904, USA

Description

ESSENTIAL FUNCTIONS:

• Inherent Risk Assessment: Work with Business Line Owners to evaluate each proposed vendor relationship and assign the appropriate inherent risk tier.
• Rigorous Document Analysis: Collect, review, and challenge third-party control documentation, including SOC 1 and SOC 2 Type II reports, audited financials, and business continuity plans.
• Contract Safeguards: Work with Legal and Procurement to include required regulatory provisions in vendor contracts, such as audit rights, service-level agreements (SLAs), and data security requirements.
• Secure Offboarding: Coordinate offboarding for terminated relationships, verifying data destruction, system access removal, and final contract closeout.

Periodic Reviews & Continuous Monitoring

• Periodic Reassessments: Maintain the review schedule and conduct formal periodic risk assessments for all third parties in accordance with the Bank’s Third-Party Relationship Risk Management Program.
• Financial Viability Monitoring: Evaluate the ongoing financial health of critical third parties using financial statements and credit metrics to identify risks that could disrupt operations.
• Issue and Gap Remediation: Document deficiencies identified during periodic reviews, track corrective actions, and work with vendor contacts to meet remediation deadlines.
• Fourth-Party Risks: Identify and monitor concentration risks where primary vendors rely heavily on critical downstream subcontractors.
• Lead Enterprise Third-Party Disruption Drills: Orchestrate annual, bank wide BCP and Pandemic tabletop exercises centered on critical third-party outages. Collaborate across all business lines to simulate, evaluate, and strengthen the bank's collective resilience during a major vendor crisis

Governance, FDIC Exam Readiness & Reporting

• Regulatory Alignment: Maintain and periodically update the Bank’s TPRM framework to reflect current regulatory requirements and the Interagency Guidance on Third- Party Relationships.
• Executive Reporting: Prepare vendor risk summaries, concentration dashboards, and open-issue logs for review by the Board of Directors.
• Exam Liaison: Serve as the principal point of contact for internal auditors and examiners regarding the third-party risk management program.
• Perform other duties as assigned.

REQUIRED SKILLS/ABILITIES:

• Excellent verbal and written communication skills.
• Strong organizational and time-management skills, with close attention to detail and a demonstrated ability to meet deadlines.
• Ability to work independently to achieve goals and objectives.
• Ability to evaluate key contract provisions and propose changes as necessary
• Proficient with Microsoft Office Suite or related software.
• Strong ability to interpret and evaluate information security posture, SOC reports, and financial statements of corporate vendors.

SUPERVISORY RESPONSIBLITY:

• This position does not supervise employees.

EDUCATION and EXPERIENCE:

• High school diploma or equivalent required.
• Bachelor’s degree in business or a related field preferred. In lieu of a bachelor’s degree, a minimum of (five) 5 years of equivalent experience is required.
• Experience in using and administering a dedicated vendor management platform is preferred.
• Knowledge of the Interagency Guidance on Third-Party Relationships, FFIEC IT examination handbooks, and GLBA data privacy expectations preferred.
• Professional Certifications: CTPRP, CISA, CRISC, or a comparable professional certification is preferred.

PHYSICAL REQUIREMENTS:

• Ability to maintain concentration and mental alertness are needed to perform the position’s responsibilities.
• Ability to lift to and move up to 25 pounds.
• Ability to communicate effectively with customers and staff in person, by email, and by telephone.
• Ability to sit or stand for extended periods.
• The position may require close vision and the ability to adjust focus.
• Reasonable accommodation may be made to enable individuals with disabilities to perform the essential functions

Equal Opportunity Employer/Protected Veterans/Individuals with Disabilities
This employer is required to notify all applicants of their rights pursuant to federal employment laws.For further information, please review the Know Your Rights notice from the Department of Labor.