Vendor Risk Management Officer

Banco Sabadell Miami; Miami (FL); On-site; USD 90,000 - 130,000; Full time

Job summary

Banco Sabadell Miami seeks a Vendor Risk Management Officer to lead the VRM program execution, governance, and due diligence for third-party vendors in our U.S. operations.

You will coordinate onboarding, risk assessments, evidence management, and reporting for regulatory and internal stakeholders, partnering with Information Security, Compliance, Legal, and Procurement.

Fluency in English and Spanish is required; 3–5 years in VRM or related fields; bachelor’s degree.

Qualifications

• Bachelor’s degree or equivalent professional experience.
• 3–5 years in VRM, third-party risk, or related control functions.
• Direct VRM or third-party due-diligence experience preferred.
• Familiarity with DORA, concentration risk and vendor exit planning is a plus.
• English and Spanish fluency required.

Responsibilities

• VRM program execution and governance.
• Coordinate onboarding through Venminder/NContracts.
• Perform due diligence across information-security, privacy, business-continuity, financial and contractual domains.
• Maintain audit-ready VRM evidence for onboarding, reviews, and remediation.
• Prepare VRM reports and dashboards for the CISO, committees, audits, and Head Office.
• Coordinate annual VMOR and exit-strategy planning.

Skills

Vendor risk management

Regulatory/compliance knowledge

English and Spanish proficiency

Risk assessment

Stakeholder coordination

Education

Bachelor’s degree or equivalent

Tools

Venminder

NContracts

Job description

If you are unable to complete this application due to a disability, contact this employer to ask for an accommodation or an alternative application process.

Compliance Professional Miami Lakes, FL, US

6 days ago Requisition ID: 1722

Sabadell is a global financial institution headquartered in Barcelona, Spain and one of Europe’s oldest and most successful banking groups since its founding in 1881. Sabadell covers all areas of the financial business sector under a common denominator: professional performance and quality. In the United States, Sabadell has operated with an International Full Branch since 1993. We offer Corporate Banking services to international companies in the American market, and Private Banking services primarily to Latin American high net worth individuals and families.

Banco Sabadell is seeking a Vendor Risk Management Officer candidate to join a dynamic team within one of the fastest growing banks in Florida.

Essential Duties and Responsibilitie s

• VRM Program Execution and Governance
• Execute the day-to-day requirements, procedures, workflows, and control activities of the Vendor Risk Management program under the direction of the CISO.
• Serve as the day-to-day liaison with the Head Office VRM Department for program expectations, reporting, methodology alignment, and issue escalation.
• Maintain and improve the VRM calendar covering onboarding, periodic reviews, VMOR activities, risk reassessments, committee deliverables, audit requests, and reporting deadlines.
• Track program obligations, follow up with accountable parties, document completion, and 2??
• Analyze control gaps, process efficiency, and risk trends and recommend program improvements to the CISO; management retains approval of policy changes, exceptions, and risk acceptance.
• Vendor Onboarding and Due Diligence
• Coordinate new-vendor onboarding through the Bank’s approved VRM workflow tool, currently Venminder/NContracts, or any successor platform.
• Work with business owners and subject-matter experts to obtain information-security, business-continuity, privacy, compliance, financial, operational, and contractual due diligence.
• Review submissions for completeness and consistency and drive follow-up with business owners, vendors, and internal reviewers.
• Perform or coordinate inherent-risk assessments, risk tiering, and control reviews based on vendor criticality, data exposure, regulatory impact, service dependency, and scope.
• Confirm required approvals are documented before onboarding or renewal and 2??.
• Periodic Reviews, VMOR, and Ongoing Monitoring
• Coordinate the annual VMOR process with business owners, risk contributors, and control partners.
• Complete periodic reviews to confirm vendor use remains consistent with the executed agreement, approved service scope, risk rating, and control expectations.
• Prepare and maintain User Consideration Forms or equivalent evidence of ongoing review and oversight.
• Monitor vendor alerts, risk intelligence, service changes, control issues, contract expirations, and other reassessment triggers.
• Track remediation plans, findings, risk acceptances, exceptions, and overdue actions through closure; elevate aging, high-risk, or disputed items to the CISO and relevant governance forum.
• Audit, Regulatory, and Evidence Management
• Support internal audit, external audit, regulatory, and Head Office requests concerning VRM and third-party oversight.
• Maintain complete, organized, and audit-ready evidence for onboarding, due diligence, contracts, periodic reviews, control assessments, approvals, risk decisions, and remediation.
• Coordinate evidence collection with business owners, Operational Risk Management, Financial Risk Management, Information Security, Procurement, Legal, Compliance, and other stakeholders.
• Identify recurring findings, documentation gaps, and process weaknesses and recommend corrective actions to the CISO.
• Prepare status updates, draft management responses, and supporting materials for VRM observations, issue tracking, and closure validation, subject to management review.
• DORA, Concentration Risk, and Exit Strategy Planning
• Coordinate with Head Office to support DORA-aligned third-party ICT risk requirements, including identification of vendors supporting critical, important, or essential business services.
• Collect, validate, and maintain vendor-dependency data used to assess concentration risk across vendors, services, business lines, legal entities, geographies, technology platforms, and subcontracting chains.
• Support Operational Risk Management, Financial Risk Management, Information Security, business owners, and Head Office in evaluating reliance on single providers, connected providers, and non-substitutable ICT services.
• Maintain documentation of concentration-risk assumptions, data sources, methodology, risk acceptance, and escalation of high-concentration scenarios.
• Coordinate annual exit-strategy tabletop exercises for essential vendors, including scenario preparation, participants, evidence, lessons learned, action tracking, and reporting.
• Support updates to vendor exit and transition plans so they remain operationally credible and address business continuity, data portability, service substitution, and orderly termination.
• Contracts, Reporting, and Stakeholder Coordination
• Confirm vendor contracts are current, fully executed, retained in the appropriate repository, and aligned with the approved service scope and risk classification; refer legal interpretation to Legal.
• Maintain complete records of contracts, due diligence, risk assessments, oversight, approvals, exceptions, and remediation evidence.
• Prepare accurate VRM reports, dashboards, presentations, metrics, and executive summaries for the CISO, committees, audits, Head Office, and other governance forums.
• Coordinate inputs with Operational Risk Management and Financial Risk Management and help ensure vendor risks are reflected consistently across applicable risk processes.
• Facilitate communication among business owners, vendors, control partners, and management to complete assessments, approvals, remediation, and reporting on time.
• Support related control activities assigned by the CISO, including the Clean Desk test and other governance, compliance, or risk-awareness activities.

Minimum Qualifications

• Bachelor’s degree or equivalent relevant professional experience.
• 3–5 years of experience in Vendor Risk Management, third-party risk, Risk Management, Compliance, Information Security/GRC, Operational Risk, Internal Audit, Procurement risk, or a related control function; financial-services experience is preferred.
• Direct VRM or third-party due-diligence experience is preferred. Candidates from other Risk and Compliance disciplines will be considered when they demonstrate transferable experience in risk assessment, control testing, issue management, regulatory/audit support, and stakeholder coordination.
• Experience coordinating multiple workstreams, maintaining audit-ready documentation, and escalating material risks or overdue actions.
• Familiarity with financial-institution third-party-risk expectations, DORA, concentration risk, and vendor exit planning is preferred; equivalent relevant regulatory experience is acceptable.
• Professional certification such as CTPRP, CRVPM, CISA, CRISC, CRCM, or a comparable risk/compliance credential is a plus, not required.
• Ability to speak, write and read English and Spanish fluently (required)

Sabadell is an Equal Employment Opportunity Employer