Vendor Risk Management Officer

Sabadellbank; Florida; Vor Ort; USD 90.000 - 130.000; Vollzeit

Zusammenfassung

Sabadell is seeking a Vendor Risk Management Officer in Miami Lakes, FL to lead VRM program governance, onboarding, and ongoing risk assessments. The role requires strong collaboration with the Head Office VRM team and business owners, ensuring timely due diligence and compliance across vendor relationships.

The ideal candidate has 3–5 years in VRM or related risk areas and is fluent in English and Spanish.

Qualifikationen

• Bachelor’s degree or equivalent relevant professional experience.
• 3–5 years of Vendor Risk Management or related risk management experience; financial services preferred.
• Experience coordinating multiple workstreams and escalating material risks.
• Familiarity with DORA, concentration risk, and vendor exit planning preferred.
• Fluency in English and Spanish (written and spoken).

Aufgaben

• Execute VRM program governance, onboarding, and due diligence activities.
• Collaborate with Head Office VRM and business owners to gather information-security and regulatory data.
• Coordinate vendor onboarding through Venminder/NContracts or successors and ensure complete submissions.
• Perform inherent-risk assessments, risk tiering, and control reviews based on vendor criticality.
• Coordinate annual VMOR process and periodic reviews, tracking remediation and escalation as needed.
• Support audits and regulatory requests with organized, audit-ready VRM evidence.
• Assist in concentration-risk assessment and exit-strategy planning for essential vendors.

Kenntnisse

Bilingual English/Spanish

Ausbildung

Bachelor’s degree

Jobbeschreibung

If you are unable to complete this application due to a disability, contact this employer to ask for an accommodation or an alternative application process.

Professional Miami Lakes, FL, US

Sabadell is a global financial institution headquartered in Barcelona, Spain and one of Europe’s oldest and most successful banking groups since its founding in 1881. Sabadell covers all areas of the financial business sector under a common denominator: professional performance and quality. In the United States, Sabadell has operated with an International Full Branch since 1993. We offer Corporate Banking services to international companies in the American market, and Private Banking services primarily to Latin American high net worth individuals and families.

Banco Sabadell is seeking a Vendor Risk Management Officer candidate to join a dynamic team within one of the fastest growing banks in Florida.

Essential Duties and Responsibilitie s

• VRM Program Execution and Governance
• Execute the day-to-day requirements, procedures, workflows, and control activities of the Vendor Risk Management program under the direction of the CISO.
• Serve as the day-to-day liaison with the Head Office VRM Department for program expectations, reporting, methodology alignment, and issue escalation.
• Maintain and improve the VRM calendar covering onboarding, periodic reviews, VMOR activities, risk reassessments, committee deliverables, audit requests, and reporting deadlines.
• Track program obligations, follow up with accountable parties, document completion, and **escalate** delays or material issues.
• Analyze control gaps, process efficiency, and risk trends and recommend program improvements to the CISO; management retains approval of policy changes, exceptions, and risk acceptance.
• Vendor Onboarding and Due Diligence
• Coordinate new-vendor onboarding through the Bank’s approved VRM workflow tool, currently Venminder/NContracts, or any successor platform.
• Work with business owners and subject-matter experts to obtain information-security, business-continuity, privacy, compliance, financial, operational, and contractual due diligence.
• Review submissions for completeness and consistency and drive follow-up with business owners, vendors, and internal reviewers.
• Perform or coordinate inherent-risk assessments, risk tiering, and control reviews based on vendor criticality, data exposure, regulatory impact, service dependency, and scope.
• Confirm required approvals are documented before onboarding or renewal and **escalate** unresolved findings, exceptions, or residual-risk decisions to the appropriate approver.
• Periodic Reviews, VMOR, and Ongoing Monitoring
• Coordinate the annual VMOR process with business owners, risk contributors, and control partners.
• Complete periodic reviews to confirm vendor use remains consistent with the executed agreement, approved service scope, risk rating, and control expectations.
• Prepare and maintain User Consideration Forms or equivalent evidence of ongoing review and oversight.
• Monitor vendor alerts, risk intelligence, service changes, control issues, contract expirations, and other reassessment triggers.
• Track remediation plans, findings, risk acceptances, exceptions, and overdue actions through closure; **escalate** aging, high-risk, or disputed items to the CISO and relevant governance forum.
• Audit, Regulatory, and Evidence Management
• Support internal audit, external audit, regulatory, and Head Office requests concerning VRM and third-party oversight.
• Maintain complete, organized, and audit-ready evidence for onboarding, due diligence, contracts, periodic reviews, control assessments, approvals, risk decisions, and remediation.
• Coordinate evidence collection with business owners, Operational Risk Management, Financial Risk Management, Information Security, Procurement, Legal, Compliance, and other stakeholders.
• Identify recurring findings, documentation gaps, and process weaknesses and recommend corrective actions to the CISO.
• Prepare status updates, draft management responses, and supporting materials for VRM observations, issue tracking, and closure validation, subject to management review.
• DORA, Concentration Risk, and Exit Strategy Planning
• Coordinate with Head Office to support DORA-aligned third-party ICT risk requirements, including identification of vendors supporting critical, important, or essential business services.
• Collect, validate, and maintain vendor-dependency data used to assess concentration risk across vendors, services, business lines, legal entities, geographies, technology platforms, and subcontracting chains.
• Support Operational Risk Management, Financial Risk Management, Information Security, business owners, and Head Office in evaluating reliance on single providers, connected providers, and non-substitutable ICT services.
• Maintain documentation of concentration-risk assumptions, data sources, methodology, management review, risk acceptance, and escalation of high-concentration scenarios.
• Coordinate annual exit-strategy tabletop exercises for essential vendors, including scenario preparation, participants, evidence, lessons learned, action tracking, and reporting.
• Support updates to vendor exit and transition plans so they remain operationally credible and address business continuity, data portability, service substitution, and orderly termination.
• Contracts, Reporting, and Stakeholder Coordination
• Confirm vendor contracts are current, fully executed, retained in the appropriate repository, and aligned with the approved service scope and risk classification; refer legal interpretation to Legal.
• Maintain complete records of contracts, due diligence, risk assessments, oversight, approvals, exceptions, and remediation evidence.
• Prepare accurate VRM reports, dashboards, presentations, metrics, and executive summaries for the CISO, committees, audits, Head Office, and other governance forums.
• Coordinate inputs with Operational Risk Management and Financial Risk Management and help ensure vendor risks are reflected consistently across applicable risk processes.
• Facilitate communication among business owners, vendors, control partners, and management to complete assessments, approvals, remediation, and reporting on time.
• Support related control activities assigned by the CISO, including the Clean Desk test and other governance, compliance, or risk-awareness activities.

Minimum Qualifications

• Bachelor’s degree or equivalent relevant professional experience.
• 3–5 years of experience in Vendor Risk Management, third-party risk, Risk Management, Compliance, Information Security/GRC, Operational Risk, Internal Audit, Procurement risk, or a related control function; financial-services experience is preferred.
• Direct VRM or third-party due-diligence experience is preferred. Candidates from other Risk and Compliance disciplines will be considered when they demonstrate transferable experience in risk assessment, control testing, issue management, regulatory/audit support, and stakeholder coordination.
• Experience coordinating multiple workstreams, maintaining audit-ready documentation, and escalating material risks or overdue actions.
• Familiarity with financial-institution third-party-risk expectations, DORA, concentration risk, and vendor exit planning is preferred; equivalent relevant regulatory experience is acceptable.
• Professional certification such as CTPRP, CRVPM, CISA, CRISC, CRCM, or a comparable risk/compliance credential is a plus, not required.
• Ability to speak, write and read English and Spanish fluently (required)

Sabadell is an Equal Employment Opportunity Employer